Preparing to Meet the New CMS Emergency Preparedness Rule

According to the National Oceanic and Atmospheric Administration,(1) 2015 marked the eighth consecutive year that disasters from extreme weather have cost the U.S. economy more than $10 billion. This trend continued in 2016 with massive snowstorms in the Northeast, flooding in Baton Rouge, and earthquakes, forest fires, tornadoes, and hurricanes across the country. Business owners, including healthcare providers, are more aware than ever of the financial necessity of preparing their businesses for the unexpected.

Natural and manmade disasters also have put the health and safety of the public at risk, spurring CMS to issue a rule to establish consistent emergency preparedness requirements for healthcare providers participating in Medicare and Medicaid; increase patient safety during emergencies; and establish a more coordinated response to natural and manmade disasters.

In September 2016, CMS issued the final Emergency Preparedness Rule, which outlines the requirements for all providers and suppliers in regard to planning, preparing, and training for emergency situations. The rule includes emergency plans, communication and accountability requirements, as well as guidelines for the training of staff. Although there are minor variations based on the specific provider type, the rule is applicable to all providers and suppliers. These new requirements will require certain participating providers and suppliers to plan for disasters and coordinate with federal, state, tribal, regional, and local emergency preparedness systems to ensure that facilities are adequately prepared to meet the needs of their patients during disasters and emergency situations. However, the new Emergency Preparedness requirements do not apply to physician offices that are not part of a certified Medicare-participating facility. Physicians’ offices or practices that are considered part of a certified Medicare participating facility would be required to meet the regulations. Healthcare providers and suppliers affected by this rule must comply and implement all regulations one year after the effective date, on November 16, 2017.

The final rule standards are adjusted to reflect the characteristics of each type of provider and supplier. For example:

• Outpatient providers and suppliers such as ambulatory surgical centers and end-stage renal disease facilities will not be required to have policies and procedures for provision of subsistence needs.

• Hospitals, critical access hospitals, and long-term care facilities will be required to install and maintain emergency and standby power systems based on their emergency plan.

If a Medicaid provider is required to meet the requirements for participation in Medicare in order to receive Medicaid payment, that provider is required to comply with the emergency preparedness requirements, along with all of the other Medicare Conditions of Participation (CoPs) for that provider. For example, Medicaid-only hospitals must meet the Medicare requirements so that they comply with all of the hospital CoPs, including the emergency preparedness requirements.

The final rule requires Medicare- and Medicaid-participating providers and suppliers to meet the following four common and well-known industry best practice standards:

• Emergency plan: Based on a risk assessment, develop an emergency plan using an all-hazards approach focusing on capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters specific to the location of a provider or supplier.

• Policies and procedures: Develop and implement policies and procedures based on the plan and risk assessment.

• Communication plan: Develop and maintain a communication plan that complies with both federal and state law. Patient care must be well coordinated within the facility, across healthcare providers, and with state and local public health departments and emergency systems.

• Training and testing program: Develop and maintain a training and testing program, including initial and annual trainings, and conduct drills and exercises or participate in an actual incident that tests the plan.

Your medical practice must have a well-organized training program that includes training for new and existing staff in emergency preparedness policies and procedures as well as an annual refresher trainer course. Your facility must offer annual emergency preparedness training in which staff can demonstrate knowledge of emergency procedures. The facility must also conduct drills and exercises to test emergency plans to identify gaps and areas for improvement.

CMS expects facilities to delineate responsibilities for all of their facility workers in their emergency preparedness plans and determine the appropriate level of training for each professional role. Therefore, your facility will have discretion in determining what encompasses appropriate training for the different staff positions and roles.

Monitors

Who will be monitoring your compliance? The state survey agencies, accreditation organizations, and CMS regional offices will be involved in monitoring for compliance, as is the case with all other requirements for participation in Medicare. Facilities may choose to work with local health and emergency management officials to review the facility’s plan to meet local requirements. Providers and suppliers have one year to implement the emergency preparedness requirements. Surveying for compliance with these requirements will begin on November 15, 2017.

There will be no exemptions from the requirements, and penalties for noncompliance will follow the same process as with any other CoPs and Conditions for Coverage (CfCs) for the facility at hand. The implementation of this new regulation is not linked to an incentive program. Facilities found to be out of compliance with the requirements will be subject to the same enforcement process as with any other CoP/CfC that is out of compliance. These new regulations are a condition of or requirement to participate in Medicare.

Documenting Your Plan

Medical practices must identify potential vulnerabilities within their organizations and take the appropriate steps to deal with disasters.

CMS is not requiring a specific format for how a facility should have its emergency plans documented and in which order. However, upon survey, a facility must be able to provide documentation of these requirements in the plan and show where the plans are located.

A well-organized, effective training program must include initial training for new and existing staff in emergency preparedness policies and procedures as well as annual refresher trainings. The facility must offer annual emergency preparedness training during which staff can demonstrate knowledge of emergency procedures. The facility also must conduct drills and exercises to test the emergency plan to identify gaps and areas for improvement. CMS expects facilities to delineate responsibilities for all of their facility’s workers in their emergency preparedness plans and to determine the appropriate level of training for each professional role. Therefore, facilities will have discretion in determining what encompasses appropriate training for the different staff positions or roles.

Unlike the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) rule, implementation of this new regulation is not linked to an incentive program. Facilities found to be out of compliance with the requirements will be subject to the same enforcement process as with any other CoP/CfC that is found to be out of compliance. These new regulations are a condition or requirement to participate in Medicare. CMS anticipates releasing the Interpretive Guidelines and Survey Procedures in the spring of 2017. In the interim, CMS is posting helpful tools and relevant information on the Survey & Certification Group Emergency Preparedness website to assist facilities in meeting the requirements.

To afford providers the flexibility to develop disaster drills and exercises that are realistic and reflect their risk assessments, CMS did not define “community,” allowing the term to mean entities within a state or in a multi-state region. The goal of the provision is to ensure that healthcare providers collaborate with other entities within a given community to promote an integrated response. CMS expects hospitals and other providers to participate in healthcare coalitions in their area for additional assistance in effectively meeting the “community” requirement. Conducting exercises at the healthcare coalition level could help to reduce the administrative burden on individual healthcare facilities and demonstrate the value of connecting into the broader medical response community, as well as the local health and emergency management agencies, during emergency preparedness planning and response activities.

Actions to Minimize the Impact of Emergencies

The following sections discuss four actions medical practices should take to minimize the impact of emergencies and natural disasters on operations and financial health regardless of whether or not you are required to adhere to the Emergency Preparedness Rule.

Create a disaster preparedness plan.

Preparing a plan of action prior to an event helps reduce risk as much as possible. Identify potential vulnerabilities and evaluate the risk they pose to business continuity. For example, problems can arise when employees do not have the right equipment to respond to customer needs when the office or company data are not accessible.

Identify the most critical daily operations and establish procedures for handling them during an emergency. For example, practices should consider an alternate location in the event that the office becomes unusable.

Test the disaster preparedness plan.

Practices should test and refine their disaster preparedness plan by running regular drills, ensuring everyone feels comfortable with the procedures. Even the most well-reasoned plan must be practiced in order to avoid human error and the resulting downtime and lost revenue.

Emphasize communication, and offer the ability to work remotely.

Communication is always vital to business success, but this reality is accentuated during emergencies. From the ability to communicate with staff to the capacity to address the needs and concerns of the patients they serve, practices must arm employees with the tools and capabilities they need in order to communicate and work efficiently from remote locations, so that work is not disrupted if an office must close.

It is best to house 100% of communications in the cloud.

For example, practices should look for cloud-based IP phone systems. Features such as mobile twinning, which sends inbound calls to mobile and desk phones simultaneously, ensure employees are available to patients anytime, anywhere. To keep a practice functioning optimally, it is best to house 100% of communications in the cloud. Retaining communication programming and settings in the cloud, rather than in a physical phone, helps prevent disruption and allows practices to leverage features such as softphones, which allow any Internet-connected PC, iPad, iPhone, or Android device to be used as a phone extension.

Leverage the cloud.

Patient and other practice data are irreplaceable, and the financial consequences of being unable to access key information and applications in the event of a disaster can be severe. Using a cloud-based storage system keeps data safe and accessible, regardless of what happens at the physical point of operations.

For maximum reliability, practices should look for cloud-based data back-up solutions with multiple data centers to ensure undisrupted access to files if a regional disaster affects one of the data centers. Practices should also consider transitioning servers to the cloud for improved scalability. With the ability to increase off-site server capacity through a web-based portal, organizations become more nimble in avoiding potential disruptions.

Housing data and servers in the cloud provides a much more secure way to store business information, with the added benefit of universal access for employees working off-site.

Preparing and testing a formal disaster preparedness plan is critical in reducing the risk and impact of the unexpected on operations and financial health. Enabling seamless remote work with cloud-based communication solutions and leveraging the cloud to house servers and to back up data are also fundamental steps in minimizing vulnerability.

Resources

The final rule also includes a number of local and national resources related to emergency preparedness, including helpful reports, toolkits, and samples. Additionally, healthcare providers and suppliers can choose to participate in their local healthcare coalitions, which provide an opportunity to share resources and expertise in developing an emergency plan and can also provide support during an emergency.

CMS does not expect to develop training specifically for providers and suppliers. Healthcare associations and state, local, and other federal healthcare agencies may, however, provide training for providers and suppliers. Training provided by these organizations is only a tool to assist facilities in preparing for implementation of the rule, though, and does not mean that a provider or supplier is in compliance merely by having received the training.

The Assistant Secretary for Preparedness and Response has developed the Healthcare COOP & Recovery Planning document, which includes information to assist facilities in planning for continuity of operations,(2) and a list of accrediting organizations is available online.(3)

For more information please see a blog post by Dr. Nicole Lurie, Health and Human Services Assistant Secretary for Preparedness and Response, at https://www.healthit.gov/buzz-blog/author/nicole-lurie/ , and the CMS Survey & Certification Emergency Preparedness webpage at www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/index.html .

References

1. National Centers for Environmental Information. Billion-dollar weather and climate disasters: table of events. www.ncdc.noaa.gov/billions/events .

2. Assistant Secretary for Preparedness and Response. Healthcare COOP & recovery planning: concepts, principles, templates & resources. www.phe.gov/Preparedness/planning/hpp/reports/Documents/hc-coop2-recovery.pdf .

3. CMS-Approved Accrediting Organizations: Contacts for Prospective Clients. www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertificationGenInfo/Downloads/Accrediting-Organization-Contacts-for-Prospective-Clients-.pdf .