Source: https://www.ecri.org/components/HRC/Pages/SafSec6.aspx
Timestamp: 2019-04-26 06:31:35+00:00

Document:
​​​​​​​​No longer is it sufficient to manage emergencies as they arise; rather, hospitals must plan and prepare, in advance, to mitigate, respond to, and recover from natural and human-made emergencies and disasters.
Out-of-court settlements for deaths and injuries at hospitals during Hurricane Katrina in 2005 made clear that failure to properly prepare for and respond to an emergency can result not only in a horrible human toll but also in disastrous financial consequences for a hospital. Media coverage of several recent natural disasters highlighted providers who demonstrated little to no advanced emergency planning and woefully inadequate responses, placing patient lives at risk and in some cases resulting in patient deaths. Media accounts of emergency planning failures during 2017 Hurricanes Harvey, Irma, and Maria demonstrate that much work remains for hospitals and other providers to complete in order to be sufficiently prepared for events from service disruptions to major disasters. The correct question to ask is not if, but when, will an emergency occur? Then ask, will the organization be ready?
High-visibility disasters have led the federal government to emphasize community-wide emergency planning. The Centers for Medicare and Medicaid Services (CMS) issued the emergency preparedness final rule in 2017, establishing "national emergency preparedness requirements for Medicare and Medicaid participating providers and suppliers to plan adequately for both natural and man-made disasters, and coordinate with federal, state, tribal, regional, and local emergency preparedness systems." (CMS "Final Rule") The rule is enforced through conditions of participation (CoPs) for Medicare and Medicaid service providers. The scope of the regulation was expanded to apply to 17 types of Medicare and Medicaid providers and suppliers, but it excludes fire and rescue units, ambulances, and single- or multispecialty medical groups. The effective date of the regulation was November 15, 2016, with an implementation date of November 15, 2017. In June 2017, CMS released an advance copy of its State operations manual: interpretive guidance for surveyors. Providers can use this guidance to evaluate the organization's emergency preparedness program.
The CMS regulations require organizations to take a "comprehensive, consistent, flexible, and dynamic regulatory approach to emergency preparedness and implement a response that incorporates the lessons learned from the past, combined with the proven best practices of the present into an emergency operations program" (CMS "Final Rule").
CMS contends these new regulations strike a balance between being specific and general that permits providers and suppliers to develop an effective emergency operations plan (EOP).
Risk managers often play a direct role in the development of policies and procedures related to emergency management—such as those addressing disaster-related standards of care, modification of the privileging and credentialing process, and negotiation of mutual-aid agreements with other hospitals. A comprehensive understanding of emergency preparedness is necessary to be effective. This guidance article touches on operations of the emergency operations committee (EOC) and on the planning and mitigation elements of a comprehensive EOP and includes links to resources that can assist organizations in complying with CMS's emergency preparedness final rule.
Ensure that the risk manager participates with the EOC.
Confirm that the EOP is reviewed and updated, if necessary, at least annually.
Ensure that the EOP addresses key components of preparedness, mitigation, response, and recovery.
Evaluate how the hospital's EOP fits within the local, regional, and state emergency management programs.
Encourage the hospital to join a healthcare coalition (HCC).
Prepare for use of volunteer healthcare providers and nonclinical personnel.
Ensure that a process is in place for granting temporary privileges to medical staff.
Work with the ethics committee to establish crisis standards of care (CSC) and protocols for triage during disasters, and incorporate these standards and protocols into the EOP.
Ensure that both a facility-based and a community-based hazard vulnerability assessment (HVA) are conducted at least annually.
Evaluate the findings of both the facility-based and community-based HVAs.
Confirm that the EOP is consistent with the findings of both HVAs.
Review EOP policies and procedures to ensure consistency with the all-hazards focus of the HVA at least annually.
Ensure the communications plan includes alternative means for communicating with critical stakeholders.
Ensure that the incident command system (ICS) is flexible enough to address both large- and small-scale emergencies.
Work with the EOC and training coordinator to confirm that hospital staff are trained and tested regarding the EOP, their role, and their responsibilities.
Ensure that the training and testing plan is reviewed and revised, if needed, on an annual basis.
Conduct an annual community-wide drill exercise that includes a surge of incoming patients.
Conduct an annual community-wide drill exercise that simulates an event that is so far reaching that the local community cannot support the hospital.
In evaluating the readiness of the national healthcare system, the Centers for Medicare and Medicaid Services (CMS) found that while many providers and suppliers have considered emergency preparedness, their strategies do not go far enough in ensuring that they are equipped and prepared to help protect those they serve during emergencies and disasters (CMS "Final Rule"). No longer is it sufficient to manage emergencies as they arise; rather, hospitals must prepare in advance to mitigate, respond to, and recover from natural and human-made emergencies and disasters.
Studies of hospital emergency preparedness before the 2001 attacks on the World Trade Center showed that, although the level of hospital preparedness varied, most hospitals were in the early stages of emergency preparedness development. Few had planned comprehensively for large-scale events, and much of the planning focused on chemical incidents. Formal interhospital and community collaboration on emergency preparedness was uncommon, and while most hospitals were in compliance with Joint Commission standards, those standards focused primarily on physical threats to individual hospital facilities, such as bomb threats or loss of utilities (Toner et al.).
The types of emergency events and disasters for which healthcare organizations must be prepared are quite broad. See Types of External Emergencies and Disasters to examine the wide variety of recent human-made and natural disasters.
Between 2007 and September 2018, the Federal Emergency Management Agency (FEMA) declared an emergency in the United States 1,451 times (FEMA "Disaster Declarations"). The correct question to ask is not whether, but when, an emergency will occur. Then ask whether the organization will be ready.
​Beyond the tragic loss of life, the cost of damages from natural disasters has been climbing. From 1980 through 2007, no natural-disaster damage estimates reached $10 billion. In five of the years between 2008 and 2018, damage costs from natural disasters equaled or exceeded $10 billion (see Figure. Billion-Dollar Disaster Events by Year (figures adjusted for the consumer price index).
In light of these trends, the nation's health security and its readiness for public health emergencies are high priorities (ASPR TRACIE "Hospital Preparedness Program").
​​​​​Source: Office of the Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center, and Information Exchange (ASPR-TRACIE), U.S. Department of Health and Human Services. CMS emergency preparedness rule: resources at your fingertips. Updated 2017 Jun 8 [cited 2018 Apr 13].
While many risk managers are not directly involved in the emergency management planning process, all should be familiar with it, as failure to properly plan for and implement emergency operations plans (EOPs) can result in significant liability for a hospital. Risk managers often play a direct role in developing policies and procedures that relate to disaster-related standards of care, modification of the privileging and credentialing process, and negotiation of mutual-aid agreements with other hospitals.
Risk managers must understand the difference between "disasters" and "emergencies." While the general public sometimes uses the words interchangeably, the terms have different meanings in the emergency preparedness field. "Disasters" are a subset of "emergencies." A disaster is a type of emergency that overwhelms an individual hospital and requires outside assistance. An emergency, conversely, is an unexpected event that disrupts a hospital's ability to provide care but does not require outside assistance beyond, perhaps, a hazmat team or the local fire department (see Disasters and Emergencies: Definitions from Governmental and Accrediting Bodies). This distinction is particularly important for hospitals because some Joint Commission standards require different responses to emergencies and disasters (e.g., in the handling of temporary credentialing and privileging procedures). Risk managers should understand that different events trigger different responses and varied access to helpful resources. Understanding these differences can help the risk manager provide advice from a risk management perspective as events unfold. No matter how it is defined, a successful response to an emergency requires advance planning.
This guidance article uses the word "disaster" only if the term is specifically used in a Joint Commission standard, other official recommendations, or governmental emergency preparedness programs. Otherwise, the words "emergency," "incident," or "event" are used. For explanations of abbreviations used in the context of this guidance article, see Abbreviations Used in This Article​.
(1) An integrated health system must complete a hazard vulnerability assessment (HVA), and each individual facility must also complete an HVA (CMS "Final Rule" §482.15[f]).
(2) The unified EOP must include policies and procedures that address the specific needs of each type of facility within the system, including the unique circumstances, patient population served, and services offered (CMS "Final Rule" §482.15[f]).
(3) The unified EOP must include a coordinated communication plan. The information communicated should include the location of staff and patients both during and after an emergency or disaster. The regulation excludes some provider types from tracking patients after an emergency when they were transferred to a different facility (CMS "Final Rule" §482.15[b]). The transferring entity must, however, retain documentation of the specific name of the receiving facility.
(4) The training and testing will be coordinated, in the hopes of saving coalition leveraging resources, including costs and time-saving efficiencies.
Prior to 2016, healthcare facilities had been moving toward more comprehensive emergency management planning. Organizations had been developing more links to the broader community and switching to an "all-hazards" planning process, which shifts the emphasis from planning for a particular type of emergency to delineating the common features of and common strategies to be used when responding to all types of emergencies. These shifts came about as a result of changes in Joint Commission standards and recommendations of the National Fire Protection Association (NFPA), combined with requirements mandated by federal hospital preparedness grants and federal guidance, as well as the national preparedness programs, all of which are community based and use all-hazards planning (ASPR TRACIE "Hospital Preparedness Capabilities"). Since CMS issued the final rule on emergency preparedness, many of the strategies that were previously optional are now mandatory.
The U.S. Department of Health and Human Services (HHS) created the Hospital Preparedness Program (HPP) in 2002 to provide grants to help organizations prepare for bioterrorism and public health emergencies, such as pandemics, by increasing stockpiles of equipment, supplies, and pharmaceuticals (CDC "Pandemic"). HPP promotes, through regional collaboration, sustained national focus on improved healthcare preparedness and response and improved patient outcomes. It also aims to minimize the need for supplemental state and federal resources during emergencies and to enable rapid recovery in the wake of emergencies and disasters. In 2004, the program shifted to an all-hazards, capabilities-based approach. This meant that hospitals had to do more than simply purchase equipment or supplies; they needed to demonstrate the capability to perform core functions common to all responses. (CDC "Strategic") To date, over $5.3 billion has been invested to fund the HPP (ASPR TRACIE "Hospital Preparedness Program").
Hospitals that seek HPP funding support regional efforts to help patients "receive the right care at the right place at the right time." More than 86% of the nation's hospitals participate in HPP. (ASPR TRACIE "Hospital Preparedness Capabilities") HPP members must participate in a healthcare coalition (HCC). All coalitions must include four core member types: hospitals, local health departments, emergency management organizations, and emergency medical services (CDC "2017-2022").
HPP participants must also commit to working within the National Incident Management System (NIMS). NIMS was developed to help government, the private sector, and nongovernmental organizations work together "to prepare for, prevent, respond to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in order to reduce the loss of life, property, and harm to the environment" (ASPR TRACIE "NIMS Implementation"). According to FEMA, NIMS "provides stakeholders across the whole community with the shared vocabulary, systems, and processes to successfully deliver the capabilities described in the National Preparedness System." (FEMA "Top 5") Additional frequently asked questions about NIMS are available through FEMA (see Resource List​).
The ICS is a management methodology that allows a hospital to manage and respond to an emergency incident such as a terrorist attack or flooding. ICS was adapted for hospitals in 1987. Since then, what was originally termed the Hospital Emergency Incident Command System (HEICS) has been modified by dropping the letter "E" from the acronym to make clear that a Hospital Incident Command System (HICS) can be applied to both emergent and nonemergent situations.
Although not all organizations are Joint Commission accredited, the agency's standards represent good practices that are worthy of consideration. Joint Commission emergency management (EM) standards identify four phases of emergency preparedness: mitigation, preparedness, response, and recovery. Mitigation and preparedness generally occur before an emergency, while response and recovery occur during and after an emergency, largely guided by the HICS.
NFPA has one code and one standard that specifically address emergency preparedness. Like Joint Commission, however, NFPA has other codes and standards that affect emergency preparedness, such as the fire-related requirements of the Life Safety Code. NFPA's "Health Care Facilities Code" (NFPA "99") was completely rewritten and expanded in 2012 to correlate with Joint Commission emergency management standards, as well as to incorporate lessons learned from recent disasters (NFPA "Committee on NFPA 99"). The 2018 edition incorporates technical changes and new technologies and materials. NFPA 99 continues to require an organization to conduct an emergency preparedness HVA to evaluate management of critical resources and assets.
The 2016 edition of NFPA's Standard on disaster/emergency management and business continuity programs (NFPA "1600") addresses general (rather than hospital-specific) aspects of emergency management and six critical emergency management areas (the seventh critical area, disaster volunteer management, was added in 2018).
The Emergency Planning and Community Right-to-Know Act, enforced by the U.S. Environmental Protection Agency (EPA), specifically addresses the role of hospitals when a release of hazardous chemicals occurs anywhere in the community at large. The community emergency response committee is required to designate certain hospitals to treat people contaminated by the chemicals. Among other things, such hospitals must have an on-site decontamination facility, communication systems to notify the hospital from the scene of the contamination, all necessary supplies, and specially trained personnel. Designated hospitals must coordinate their training and preparation with the community emergency response committee.
The U.S. Occupational Safety and Health Administration (OSHA) requires hospitals to develop emergency action plans for the release of hazardous materials, fires, and for example, the use of ethylene oxide. OSHA requires hospitals to provide employees with appropriate personal protective equipment, such as respirators, when dealing with an emergency involving infectious airborne agents. For more information on OSHA requirements, see the guidance article OSHA Inspections, Citations, and Penalties.
Hospitals and nursing facilities may be required to have the ability to shelter patients and staff in place for certain periods. In addition, organizations need to ensure they have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR § 164.510.
For more information, see the guidance article Evacuation.
States also have the ability to declare states of emergency or disaster, and such declarations affect the manner of response and availability of resources. State emergency declarations may waive certain laws (e.g., privacy laws) and determine the extent of responsibility and liability for harm (e.g., standards of care) that arises during an incident. Some legal analysts and state policymakers address qualified standards of care, variously known as disaster, adjusted, or altered standards, or—the term that this guidance article will use—crisis standards of care. Because negligence is based on state law, any state crisis standards of care (CSCs), policy guidance, or recommendations will affect legal determinations of liability for hospitals and healthcare providers during disasters.
Action Recommendation: Ensure that the risk manager participates with the emergency operations committee (EOC).
Hospitals should have an established EOC to coordinate emergency operation efforts within the hospital or healthcare system, as well as to plan activities with nearby healthcare facilities; local, state, and federal agencies; and others. The EOC should, at minimum, include representatives with operational knowledge of and decision-making authority for Joint Commission's Seven Critical Areas. If the risk manager is not a member of the EOC, it is recommended that he or she be included in meetings periodically to ensure familiarity with key personnel and the EOP. See Potential Emergency Operations Committee Members​ for a list of personnel.
The EOC may wish to create subcommittees representing Joint Commission's seven critical areas to ensure that all important aspects of advance planning and preparation have been addressed. Input from the local emergency planning agency, public health agencies, local media, the American Red Cross, police and fire departments, and utility companies should be solicited to assist the EOC in developing the EOP. While these groups may not always be able to serve on the committee, a draft of the EOP should be sent to them for review.
Risk managers should be available to the EOC to assist with review of Joint Commission, NFPA, and NIMS requirements, as well as federal, state, and local laws relating to emergency management and response. EOC members should also pay particular attention to any state bar association guidance in these matters, including liability issues, mutual-aid agreements, and memoranda of understanding.
It is recommended that the risk manager distribute this guidance article to members of the EOC, any subcommittees, individuals with specific responsibility within the HICS, and top management.
The EOC should consider whether to recommend the creation of a separate clinical care committee or subcommittee that would determine how a hospital's resources can be best used to meet community needs and develop clinical policies and procedures required to support the response to an emergency. Membership on the clinical care committee will vary depending on the size of the hospital, the type and duration of an incident, and the scope of the challenges entailed. In addition to the chief medical officer, members could include representatives from administration, medical staff, nursing, pharmacy, respiratory therapy, infection control, critical care, emergency medicine, legal, affected specialties (such as pediatrics or burn care), and facilities.
Action Recommendation: Confirm that the EOP is reviewed and updated, if necessary, at least annually.
Action Recommendation: Ensure that the EOP addresses key components of preparedness, mitigation, response, and recovery.
Action Recommendation: Evaluate how the hospital's EOP fits within the local, regional, and state emergency management programs.
Action Recommendation: Encourage the hospital to join a healthcare coalition.
Action Recommendation: Prepare for use of volunteer healthcare providers and nonclinical personnel.
Action Recommendation: Ensure that a process is in place for granting temporary privileges to medical staff.
Action Recommendation: Work with the ethics committee to establish CSCs and protocols for triage during disasters, and incorporate these standards and protocols into the EOP.
Hospital readiness is complicated because many hospitals are accredited and must adhere not only to CMS regulations but also to accrediting body standards. In accordance with Joint Commission standard EM.02.01.01, an EOP should be "sufficiently nimble to address a range of emergencies of different duration, scale, and cause."
Emergency preparedness involves three strategies: planning, implementation, and assessment. Joint Commission standard EM.01.01.01 identifies four phases of emergency management: preparation, mitigation, response, and recovery. NFPA adds one additional phase between response and recovery (NFPA "1600" §1.1.2): continuity. When evaluating current operational challenges raised during emergencies and disasters, remember that the EOP should address different actions to be taken during each of the four or five phases. The EOP must identify alternative care sites (ACSs) for patient care—a key component in preparing for medical surge. Finally, the EOP must be updated as needed to incorporate opportunities for improvement based on findings from both facility- and community-based HVAs and findings from drills and actual events.
The written EOP, which is just one component of a hospital's emergency preparedness program, must describe how a hospital will manage all of Joint Commission's Seven Critical Areas as defined in Joint Commission standard EM.02.01.01.
Although no EOP can provide specific response instructions for a particular emergency, the plan should provide flexibility for staff to apply the critical thinking skills necessary to anticipate and respond to any emergency (MHA). All employees and medical staff, not just EOC members and department heads, must know and understand the EOP.
Joint Commission specifically requires hospitals to implement, in advance, all EOP components that require prior preparation in order to manage and provide for the seven critical areas during an emergency. Among other Joint Commission–related preparedness activities, the hospital must ensure that its ICS is integrated into, and consistent with, the community's command structure and that individuals with official roles (e.g., the incident commander) have received the proper, NIMS-compliant training. In addition, preparedness includes all training, drills, and exercises; these are performed to stress and evaluate the EOP.
Hospitals can undertake additional preparedness activities pertaining to legal and insurance matters. The 2016 edition of NFPA 1600 also suggests that recovery planning take into account issues such as the succession of individuals in leadership and other key roles, the predelegation of authority to leadership to act and to redelegate authority, steps that the facility can take to help personnel respond quickly (e.g., developing standard operating procedures for alerting, notifying, locating, and recalling personnel; delegating disaster or emergency assignments, responsibilities, and emergency duty locations), and the preparation of measures to protect resources, facilities, and personnel.
Phase 2: Mitigation. Mitigation consists of all activities that reduce or eliminate the probability of a hazard occurring or eliminate or reduce the hazard's impact if it does occur. Mitigation activities reduce loss of life and property by lessening the impact of disasters. An effective mitigation effort should begin with, and be based on, the HVA, as this will help the disaster coordinator and EOC prioritize issues during follow-up mitigation and preparedness planning (ASPR TRACIE "Management").
NFPA suggests mitigation strategies such as using applicable building construction standards to evaluate opportunities for improvement. Strategies include relocation, retrofitting, or removal of structures at risk (e.g., moving backup generators from areas susceptible to flooding); provision of protective systems for equipment at risk; and redundancy or duplication of essential personnel, critical systems, equipment, information, operations, or materials (NFPA "NFPA 99").
Phase 3: Response. Phase 3 includes the activities that directly address the hazard's impact, including actions taken immediately in anticipation of a slowly evolving incident (such as a hurricane making landfall at a foreseeable time) and actions taken during and after an impact has occurred. The response phase also proceeds based on the hospital's ICS. Response focuses on saving lives, protecting property and the environment, and meeting basic human needs after an incident.
Phase 4: Recovery. Phase 4 activities restore the hospital to "normal" after a major incident. This phase of emergency management also proceeds based on the hospital's ICS. Recovery focuses on maintaining continuity of care and restoring important community assets after an incident. Systems such as adequate staffing, shelter, infrastructure, and health and social services need to return to their preemergency status.
As emergency preparedness emerged as a high-profile concern for healthcare organizations nationwide, many experts emphasized the need for hospitals to work with other organizations in their communities to coordinate plans and ensure the most efficient, effective care possible in emergencies. Many such arrangements have evolved beyond informal discussions to formal operational HCCs.
One of the most significant factors contributing to the improved level of healthcare emergency preparedness across the nation has been the cooperative relationships occurring within individual hospitals and among neighboring hospitals, public health departments, emergency preparedness agencies, and other parties. This networking led to the emergence of formal HCCs. EOCs at hospitals that are not already participating in an HCC should consider joining one or working to form one as CoPs now require Medicare and Medicaid providers to coordinate with the broader community to develop and maintain emergency preparedness. HCCs are one of the cornerstones of national healthcare emergency preparedness. These coalitions have been extremely successful in planning and conducting disaster exercises, as well as demonstrating operational response functions during actual incidents.
Over the past two years, California has faced a variety of disasters, including multiple wildfires, flooding, and mudslides. The Disaster Resource Center (DRC) coalition in Los Angeles, California, assists providers in coordinating large-scale disaster response. Los Angeles County has more than 100 acute care hospitals serving 10 million people; it received a federal grant to coordinate planning, training, exercises, and participation in developing a regional disaster plan. The DRC coordinates surge capacity planning, facilitates drills and exercises, stockpiles pharmaceutical caches, procures supplies, coordinates staff sharing, conducts personal protective equipment and decontamination training, and facilitates communications planning. The coalition has also developed regional disaster plans and a software system for resource and bed tracking; facilitated increased interhospital communication; and provided funding for staff and disaster coordinators at participating hospitals. For more information, see the California Hospital Association Hospital Preparedness Program Checklists & Tools.
Hospitals that cannot meet the immediate needs of their patients often rely on disaster volunteers who may be licensed independent practitioners (LIPs) or non-LIPs who are legally required to have a license or other certification. Because the usual credentialing and privileging processes cannot be performed during a large-scale emergency (e.g., mass-casualty event), Joint Commission standards EM.02.01.13 and EM.02.02.15 allow for a modified process once the EOP has been activated. Criteria include verification of licensure or other certification required to practice a profession and oversight of the care, treatment, and services provided. Medical staff bylaws must identify which individuals are responsible for granting disaster privileges for LIPs, and the hospital must do the same for non-LIP disaster volunteers.
There is help. The Emergency System for Advance Registration of Volunteer Health Professionals (ESAR-VHP) helps preregister volunteer health professionals and verifies their credentials and qualifications in advance of an emergency. All 50 states have operational ESAR-VHP systems with registered volunteers who can be deployed within 24 hours. The usual deployment lasts two weeks. The ESAR-VHP program is administered at the state level.
A medical reserve corps (MRC) is also housed within the office of the Assistant Secretary for Preparedness and Response (U.S. HHS). The MRC had nearly 200,000 volunteers in 982 units across all states and reported participation in approximately 15,440 local activities in 2017. Together, these two units—ESAR-VHP and the MRC—can provide volunteer public health and medical capability coverage to 91% of the U.S. population (ASPR TRACIE "Medical Reserve Corps").
Before any volunteer can provide patient care, the hospital must obtain a valid government-issued photo identification (ID), such as a driver's license; at least one proof of licensure such as a current picture ID from a healthcare organization; ID indicating that the individual is a member of a recognized state or federal response organization (e.g., ESAR-VHP or a disaster medical assistance team); or confirmation by a currently privileged hospital practitioner or by a staff member with personal knowledge of the volunteer practitioner's ability to act as an LIP volunteer practitioner during a disaster.
Policies and procedures must address the use of volunteers in an emergency and other emergency staffing strategies, including the process for integration of state or federally designated healthcare professionals to address surge needs during an emergency (42 CFR § 482.15[b]). A variety of legal issues need to be addressed regarding the use of volunteers, such as workers' compensation coverage, malpractice coverage, OSHA requirements, financial arrangements for payment, and liability. Risk managers should ensure that these areas have been properly addressed. For example, hospitals can develop a letter of agreement covering such issues as the volunteer's relationship to the healthcare organization and the time limits for that relationship or a waiver of compensation and indemnifications granted by local laws or statutes. Many state bar associations have done work on these matters. For more information, see the guidance article Medical Staff Credentialing and Privileging.
Federal preparedness planning includes funding and guidance to help hospitals prepare for surge capacity. Hypothetical scenarios sometimes address catastrophic health events with truly horrific numbers of casualties. This type of planning is being done at the regional level as well, anticipating medical responses from all hospitals and healthcare systems in a given area. For many hospitals, just a few more casualties than usual can cause them to reach surge capacity. For example, most hospitals in Canada may begin to fail if five or more critically injured patients arrive simultaneously (McAlister), and in England, the Royal London Hospital received 194 casualties from the July 2005 terrorist attacks and resuscitation room capacity was reached within 15 minutes (Aylwin).
ACSs may be either fixed or mobile. Fixed sites are nonmedical buildings, such as hotels, armories, or auditoriums that are close enough to the hospital and the right size to be adapted to provide medical care (Joint Commission "Health Care"). Mobile medical facilities are either tractor-trailer-based specialized units with surgical and intensive care capabilities or fully equipped hospitals stored in container systems.
Risk managers should consider several issues when reviewing their facilities' identified ACSs, including the level and scope of medical care to be delivered, the physical infrastructure required, staffing requirements for the delivery of such care, the medical equipment and supplies needed, and the management systems required to integrate such facilities with the overall delivery of healthcare (GAO). However, although most ACSs are used for patient care, some may also be used for patient evacuation, which requires different plans, staffing, and resources (MHA).
Action Recommendation: Ensure that both a facility-based and a community-based HVA are completed at least annually.
Action Recommendation: Evaluate the findings of both the facility-based and community-based HVAs.
Action Recommendation: Confirm that the EOP is consistent with the findings of both HVAs.
Action Recommendation: Review EOP policies and procedures to ensure consistency with the all-hazards focus of the HVA at least annually.
(1) Determine the methodology the entity will use to conduct the assessment and determine whether the entity has the necessary expertise to perform the assessment.
(2) Consult with internal or external experts to assess the vulnerability of the entity's assets to identified hazards.
(3) Identify and categorize assets (e.g., human resources, buildings, equipment, operations, technology, electronic information, suppliers, vendors, third-party service providers).
(4) Identify threats and hazards—natural, human caused (accidental and intentional), and technology caused.
(5) Evaluate hazard and risk exposures to which the entity is exposed.
(6) Assess the existing current preventive measures and mitigation controls against credible threats.
(7) Categorize threats, hazard and risk exposures, and potential incidents by their relative frequency and severity. Keep in mind that many combinations of frequency and severity may be possible for each, as well as cascading impacts.
(8) Evaluate the residual hazard and risk exposures (those that remain hazardous after prevention and mitigation activities).
In accordance with CMS regulations, organizations should conduct both a facility- and a community-based HVA on at least an annual basis (CMS 42 CFR § 482.15[a]). The HVA should focus on "the capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters." The assessment should evaluate the patient population, "including but not limited to, persons at risk, the types of services that the facility would be able to provide in an emergency, continuity of operations, including delegations of authority and succession plans" (CMS "Final Rule"; 42 CFR § 482.15[a]).
Joint Commission, NFPA, FEMA, and others also require or recommend that hospitals conduct an annual HVA (see NFPA HVA Checklist​ for an example). According to Joint Commission standard EM.01.01.01, the HVA should "identify potential emergencies that could affect demand for [the organization's] services or its ability to provide those services," decide how likely the threats are, and assess their potential impact on operations. When working with community partners to prioritize the emergencies identified in the HVA, hospitals must determine which partners are critical to maintain safe operations. Joint Commission requires hospitals to communicate to community emergency response agencies about identified needs and vulnerabilities.
Types of hazards. When conducting an all-hazards assessment, hazards are often divided into categories. For example, NFPA 99 distinguishes between natural hazards (e.g., geological, meteorological, and biological), human-caused events (e.g., accidental or intentional), and technological events. A hospital may face multiple disasters simultaneously—hurricanes are often accompanied by flooding, and earthquakes may be followed by tsunamis in coastal communities.
FEMA, like other government agencies and educational institutions, has maps and statistics that can help emergency planners identify the probability of many natural hazards. While most risk managers and EOC members may have an understanding of many of the natural hazards their hospital might face (e.g., hospitals in "Tornado Alley" are likely familiar with this hazard), it is wise to do more research. For example, while 90% of American seismic activity occurs in southern California and western Nevada, 39 states are considered to include areas that face a moderate to major threat of a major earthquake (Erickson). Similarly, in the past 10 years, disastrous river flooding has occurred far more frequently than the 100-year flood event statistics would predict, according to the U.S. Geological Survey (Dinicola).
When evaluating potential hazards, an important distinction is whether a hazard is internal to the facility, such as a fire or the loss of electricity, or external. External incidents may affect the structural and nonstructural integrity of the hospital itself, damage or destroy an entire community, or have no structural effect on the hospital at all, such as in the event of a school shooting. External events may involve a high number of casualties or very few. Some external events evolve slowly, such as infectious disease epidemics or hurricanes; these disasters give hospitals (and the overall community) time to activate plans in an orderly fashion, adjust resources, and request and obtain outside assistance. However, other events, such as a bridge collapse, bombing, or mass-casualty shooting, provide little to no notice and evolve rapidly. Because staff must respond immediately, with little to no time to prepare, these events benefit most from planning, drills, and the ability to rapidly mobilize resources. (Roccaforte and Cushman) For more information, see Types of External Emergencies and Disasters​​.
​HVA tools. Many tools are available to perform an HVA, such as the Kaiser Permanente HVA. Typically, these tools ask the user to rank such things as the probability of a hazard; the human, property, business, and medical care impact; the building's structural and nonstructural vulnerabilities (windows and facades or mechanical, electrical, and piping installations); and the facility's current level of preparedness (e.g., staff training, availability of internal and external resources).
Technology risks should also be considered when looking at vulnerabilities. FEMA's most recent analysis of overall national preparedness, which includes industries other than healthcare, indicates that cybersecurity is one of the nation's biggest gaps in coverage (FEMA "National Preparedness System").
CMS requires development of policies and procedures that support the HVA process and the comprehensive implementation of the EOP. If the EOP is modified after the annual HVA, policies and procedures should also be reviewed and revised, if necessary.
Several key elements must be included in policies and procedures that support the EOP. For example, policies must address providing subsistence needs for staff and patients in case they are expected to shelter in place. The required items include food, water, and medical and pharmaceutical supplies. Other environmental factors must also be addressed, such as alternative energy sources to maintain temperatures to protect patient health and safety, to maintain the safe and sanitary storage of provisions, to provide emergency lighting, to detect fire, and to set and extinguish alarms. (42 CFR 482[b][i‐ii][A‐C]) For more information on emergency power, see Emergency and Stand-by Power Systems. Organizations should also prepare for maintaining sewage utilities and hazardous waste disposal during emergency events (CMS "Final Rule" §482.15[b][ii][D]).
Action Recommendation: Ensure the communication plan includes alternative means for communicating with critical stakeholders.
Action Recommendation: Test alternative communication methods.
Action Recommendation: Ensure that the ICS is flexible enough to address both large- and small-scale emergencies.
The new regulations require an enhanced communication plan that outlines how healthcare providers and suppliers will communicate during an emergency or disaster. Organizations must have "a system to contact appropriate staff, patients' treating physicians, and other necessary persons in a timely manner to ensure continuation of patient care functions throughout the facilities and to ensure that these functions are carried out in a safe and effective manner." (CMS "Final Rule") The communication plan must also include primary and alternate means for communicating with hospital staff and with federal, state, tribal, regional, and local emergency management agencies (CMS "Final Rule" §482.15[c]).
The emergency preparedness communication plan must be reviewed and updated, if necessary, at least annually (CMS "Final Rule" §482.15[c]). The communication plan must include the names and contact information for staff; entities providing services under arrangement; patients' physicians, other hospitals, and critical access hospitals; and disaster volunteers (CMS "Final Rule" §482.15[c]).
The communication plan should incorporate strategies for sharing demographic and medical information about patients with other healthcare providers, and for making sure that the process for sharing information will meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA) for release of information during emergencies (CMS "Final Rule" §482.15[c][4-5]). The plan should also include a process for providing to the incident command center, or its designee, information about the hospital's occupancy, needs, and ability to provide assistance (CMS "Final Rule" §482.15[c]).
In accordance with Joint Commission standard EM.02.02.01, a hospital's EOP must address how it will communicate during emergencies. Once the EOP has been activated, the public information officer and communications officer, both specific positions within the ICS, typically serve as conduits for information to internal and external stakeholders, including staff, visitors, families, and news media. The organization must plan for how information will be disseminated. Large medical systems should have a plan in place for notifying satellite sites as needed of the activation of the EOP. Disasters such as the World Trade Center attack and Hurricane Katrina exposed major weaknesses in telephone, cell phone, and police fire and radio networks. Redundant communication systems are needed (e.g., satellite phones for external communication, radio phones for internal communications) when cell phone towers become unavailable (Larkin). Meeting in advance with local radio and television stations to establish plans for mass notification of the public or of facility staff will make the process easier if it must be implemented during a real emergency (MHA).
Using social media, such as the organization's official Facebook or Twitter account, to provide information to the public in real time may help correct and clarify erroneous information or rumors. Apps for smartphones and tablet computers, hotlines, text messaging, and email can be quick ways to provide both internal and external communication. Unless otherwise authorized by the incident commander, the designated public information officer should be the only person permitted to communicate with the broader community and the media on behalf of the organization.
The ICS is a standardized, on-scene, all-hazards incident management approach that allows for the integration of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure. The ICS enables a coordinated response among different jurisdictions, government agencies, and private organizations (such as hospitals) and establishes common processes for planning and managing resources. NIMS can help organizations successfully exchange information with external stakeholders to facilitate more efficient response and recovery efforts. NIMS was developed to allow all levels of government, the private sector, and nongovernmental organizations to work together "to prepare for, prevent, respond to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in order to reduce the loss of life, property, and harm to the environment" (ASPR TRACIE "NIMS Implementation"). For more information on NIMS, see Federal Funding Requirements.
Unified command structure. Such a structure allows disparate entities (both public and private) to collaborate and actively participate in the response and recovery.
Planning, logistics, and administration/finance all support the command and the operations sections.
Comprehensive resource management. Systems are needed to describe, maintain, identify, request, and track resources.
Integrated communications. Communications should be integrated both internally and externally.
For more information about hospital ICSs, see the guidance article The Hospital Incident Command System.
Action Recommendation: Work with the EOC and training coordinator to confirm that hospital staff are trained and tested regarding the EOP, their role, and their responsibilities.
Action Recommendation: Ensure that the training and testing plan is reviewed and revised, if needed, on an annual basis.
Action Recommendation: Conduct an annual community-wide drill exercise that includes a surge of incoming patients.
Action Recommendation: Conduct an annual community-wide drill exercise that simulates an event that is so far reaching that the local community cannot support the hospital.
Joint Commission standard EM.02.02.07 requires that staff and LIPs know in advance what they are expected to do during an emergency. All training activities, from educational programs conducted outside of the hospital (e.g., formal ICS training, clinical education in disaster medicine) to training on-site (e.g., responsibilities during a fire or hazardous materials spill), must take place before an emergency occurs. Properly trained (and drilled) staff do not have to pause to think about what to do or whom to call; they simply do it. Disasters are often dynamic or chaotic situations, and effective training helps prepare staff to take on unexpected responsibilities and adjust to changes in patient volume or acuity, work procedures, or conditions without having to make ad hoc decisions.
Organizations should develop and maintain an emergency preparedness training and testing program based on the EOP, the facility- and community-based HVAs, emergency preparedness policies and procedures, and the communications plan (CMS "Final Rule" §482.15[d]). The training and testing program must be reviewed and updated at least annually (CMS "Final Rule" §482.15[d]). Mandatory training and testing should be provided to all new employees, including employed physicians, and then conducted on an annual basis thereafter (CMS "Final Rule" §482.15[d][i]). Employees must demonstrate that they understand the EOP, including their role and responsibilities (CMS "Final Rule" §482.15[d][iv]). Volunteers must also be trained and tested on their understanding of completing tasks important to their role (CMS "Final Rule" §482.15[d][i]). Documentation of the training must be maintained by the organization (CMS "Final Rule" §482.15[d][iii]).
Conducting an integrated exercise planned with state and local entities should help identify gaps in the current processes that can then be fixed before an actual emergency occurs. Community-based exercises allow organizations to test incident command and control procedures, including communication plans that are critical when an emergency creates patient surge beyond capacity. (CMS "Final Rule") ASPR-TRACIE (2017-2022) lists proper handling of surge as the fourth of the key capabilities of community-based emergency preparedness programing.
Therefore, in accordance with the Final Rule at 42 CFR § 482.15[d], the organization's EOP must be tested at least twice a year. Two annual drill exercises are conducted to test staff knowledge and to identify opportunities for improvement of emergency preparedness planning. One drill must be a full-scale exercise that is community-wide. CMS's State operations manual defines a full-scale exercise as "any operations-based exercise (drill, functional, or full-scale exercise) that assesses a facility's functional capabilities by simulating a response to an emergency that would impact the facility's operations and their given community." A full-scale exercise is also "an operations-based exercise that typically involves multiple agencies, jurisdictions, and disciplines performing functional or operational elements."
If an organization experiences a natural or human-made emergency that requires activation of the EOP, the organization is exempt from engaging in a community- or facility-based full‐scale exercise for one year following the onset of the event (CMS "Final Rule" §482.15[d][i]). The organization's response to the event must be evaluated to identify safe practices and the findings documented, including opportunities for improvement. An effective method to evaluate an organization's performance during an emergency is to conduct a debriefing of critical staff within 24 or 48 hours after the end of the event.
Other possibilities include holding a group discussion led by a facilitator, using a narrated, clinically relevant emergency scenario and a set of problem statements, directed messages, or prepared questions designed to challenge the emergency plan (42 CFR § 482.15[d][ii][B]).
Finally, organizations need to analyze the response to and maintain documentation of all drills, tabletop exercises, and emergency events. Postevent review of the EOP is included in this process. Based on evaluation of the effectiveness of the EOP during the drill or actual emergency, revisions to the EOP may be needed (42 CFR § 482.15[d][iii]).
Joint Commission standard EM.03.01.03 requires that hospitals evaluate and test their EOP by conducting actual emergency exercises at least twice a year; tabletop sessions are not enough to satisfy the entire drill requirement. However, if the organization activated the EOP, the actual response (and feedback after the response) can take the place of an exercise. Hospitals that offer emergency services, or those that are community-designated disaster receiving stations, must include an influx of simulated patients (medical surge) in this exercise; a tabletop exercise cannot be substituted for this drill. In one of their exercises, hospitals must test their capabilities by simulating an escalating event in which the local community is unable to support the hospital; tabletop sessions are acceptable for the community portion of this exercise. Additionally, hospitals that have a defined rol​e in their community's response plan must participate in at least one community-wide exercise per year; tabletop sessions are acceptable to satisfy this part of the standard. The drill exercises completed in accordance with Joint Commission standards will meet the CMS two-drill requirements.
Based on this monitoring, hospitals must use a multidisciplinary process (which includes LIPs to document and communicate deficiencies and opportunities for improvement to the improvement team responsible for monitoring environment-of-care issues). For more information on conducting exercises, see the guidance article Disaster Drills and see the Checklist for Disaster Drill Planning.
​Defines a major disaster as "any natural catastrophe . . . or, regardless of cause, any fire, flood, or explosion, in any part of the United States, which in determination of the U.S. President causes damage of sufficient severity and magnitude to warrant major disaster assistance under [the] Act to supplement the efforts and available resources of states, local governments, and disaster relief organizations in alleviating the damage, loss, hardship, or suffering caused thereby"
Sources: CMS: Centers for Medicare and Medicaid Services; FEMA: Federal Emergency Management Agency.
42 CFR § 482.15. Condition of participation: emergency preparedness. 2017.
42 USC § 116. Emergency Planning and Community Right-to-Know Act. 1986.
42 USC § 1395x. Social Security Act § 1861(e)(9). Health insurance for aged and disabled.
42 USC § 5122). Robert T. Stafford Disaster Relief and Emergency Assistance Act.
44 CFR § 206.1 et seq. Federal disaster assistance.
Final rule: emergency preparedness. 42 CFR § 482.1-§ 482.66.
Erickson J. Quakes, eruptions, and other geological cataclysms. New York (NY): Facts on File; 1994.
Finan S. Disaster preparedness: legal issues faced by hospitals in the post-Katrina environment. ABA Health eSource. 2006 Nov [cited 2018 Feb 19; link no longer available].
Health Insurance Portability and Accountability Act. Pub. L. No. 104-191 (1996).
Comprehensive accreditation manual for hospitals. Oakbrook Terrace (IL): Joint Commission Resources; 2018 Jan 1.
NFPA 99: Health care facilities code. Quincy (MA): NFPA; 2018.
NFPA 1600: Standard on disaster/emergency management and business continuity/continuity of operations programs. Quincy (MA): NFPA; 2016.

References: §482
 §482
 §482
 § 164
 §1
 § 482
 § 482
 § 482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 §482
 § 482
 §482
 § 482
 § 482
 § 482
 § 116
 § 1395
 § 1861
 § 5122
 § 206
 § 482