CMS Finalizes Rule Establishing New Emergency Preparedness Requirements

As clean-up efforts continue in the wake of Hurricane Matthew, companies in North Carolina, South Carolina, Georgia, Florida, and throughout the Southeast are focused on the importance of emergency preparedness in ensuring business continuity.  Natural and man-made disasters, such as the September 11 attacks, Hurricane Katrina, Superstorm Sandy, and public-health emergencies like the Ebola “pandemic,” demonstrate that for hospitals, health systems, and other health care providers in particular, these efforts can be the difference between life and death.  In response to well-documented inconsistencies in the level of emergency preparedness across the health care industry, the Centers for Medicare and Medicaid Services (“CMS”) recently published final preparedness requirements that providers and suppliers must meet in order to participate in the Medicare and Medicaid programs (“Final Rule”).[1]

The Final Rule, which will be effective on November 15, 2016, and must be implemented within one year, applies to 17 different types of health care providers and suppliers, including ambulatory surgical centers, psychiatric residential treatment facilities, hospitals and critical access hospitals (“CAHs”), long-term care (“LTC”) facilities, hospices, home health agencies, community mental health centers, rural health clinics, federally qualified health centers, and end-stage renal disease facilities.  The Final Rule seeks to establish a more comprehensive and consistent regulatory approach to emergency preparedness that safeguards three “key essentials” necessary to maintain access to health care services: human resources, business continuity, and physical resources.[2]  The Final Rule also includes links to a number of local and national resources for safeguarding these “key essentials.”[3]

Although CMS expects that the financial burden will decrease dramatically once participating providers have preparedness systems in place, the aggregate implementation cost for the more than 72,000 participating providers and suppliers that will be affected is estimated to be $373 million in year one and $25 million in subsequent years.[4]

New Conditions of Participation
Under the current conditions of participation, many providers are required to have some level of emergency preparedness.  For example, hospitals must provide for emergency power and lighting in specified areas and maintain an emergency gas and water supply.[5]  The Final Rule seeks to improve on this baseline by implementing “common and well-known industry best practice standards” for emergency preparedness, including: (1) risk assessment and emergency planning processes, (2) policies and procedures, (3) communication plans, and (4) training and testing programs. [6]

Risk Assessment and Emergency Planning
Going forward, participating providers and suppliers will be required to perform a risk assessment and establish an emergency plan using an “all-hazards” approach.[7]  The assessment should identify the emergencies that a provider or supplier may reasonably expect to encounter and the essential business functions necessary to continue operation in the aftermath of such an emergency.  These emergencies may include, but are not limited to, care-related emergencies, equipment and power failures, cyberattacks, loss of a facility, and interruptions in the normal supply of water and food.  The assessment should also consider risks that are specific to patient populations and any challenges presented by the provider or supplier’s location.

Notably, hospitals, CAHs, and LTC facilities will be required to implement emergency and standby power systems based on the emergency planning process.[8]  CMS originally proposed to require these facilities to conduct additional generator testing of four continuous hours every 12 months.[9]  However, due to a lack of empirical evidence that such testing would improve a facility’s ability to respond to an emergency or natural disaster, this requirement was not included in the Final Rule.[10]  Further, CMS provided these inpatient facilities with some measure of flexibility in locating new generators and did not require relocation of existing generators or create additional requirements for alternative sources of power not previously required by the National Fire Protection Association (“NFPA”).[11]

Policies and Procedures
Participating providers and suppliers will be required to implement policies and procedures to help mitigate any risks identified during the assessment process and support the successful execution of the emergency plan.  These policies will necessarily vary depending on the type of provider and its relative needs and capabilities.  For example, although inpatient facilities will need to have emergency subsistence procedures for staff and patients, this requirement would not be necessary for outpatient facilities.[12]  As another example, hospitals will need to implement a system of tracking on-duty staff and sheltered patients during an emergency.[13]  Hospitals will also need to develop arrangements with other providers to receive patients in the event of limitations or cessation of operations to maintain continuity of services.[14]

Communication Plan
Participating providers and suppliers will be required to develop and maintain an emergency communication plan.  Facilities will need to have a system in place to contact patients, medical staff, treating physicians, and other necessary personnel.  Additionally, communication plans must include contact information for federal, state, and local public health and emergency management officials, and outline a means for contacting those officials in a timely manner.[15]  Communication plans for some providers will also be required to include additional details.  As an example, hospitals must develop a method for sharing information and medical documentation for patients under the hospital’s care, as necessary, with other health care providers in order to maintain the continuity of care.[16]  Although the Final Rule does not mandate that participating facilities deploy an electronic health record, providers and suppliers are encouraged to review their medical record storage procedures as part of the planning process.[17]

Training and Testing
Perhaps most importantly, participating providers and suppliers will be required to develop, implement, and maintain training and testing programs for all new and existing staff.  Initial trainings and annual refresher trainings on the relevant policies and procedures are required, as are drills and annual exercises to test the emergency plan and identify areas for improvement.  For example, a hospital will need to participate in a full-scale, community-based preparedness exercise or an individual, facility-based exercise at least annually.[18]  A hospital will also be required to conduct an additional training exercise each year, such as a second full-scale preparedness exercise or a tabletop exercise that includes group discussions led by a facilitator.[19] 

*           *           *           *           *

In the words of Dr. Nicole Lurie, the Assistant Secretary for Preparedness and Response at the U.S. Department of Health and Human Services, “[a]s people with medical needs are cared for in increasingly diverse settings, disaster preparedness is not only a responsibility of hospitals, but of many other providers and suppliers of healthcare services.”[20]  CMS has clearly taken this directive to heart in promulgating new requirements for providers that participate in the Medicare and Medicaid programs.

Notes:
[1] Medicare and Medicaid Programs; Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers, 81 Fed. Reg. 63,860 (Sept. 16, 2016) (to be codified in 42 C.F.R. pts. 403, 416, 418, 441, 460,
482, 483, 484, 485, 486, 491, and 494).