The Centers for Medicare and Medicaid Services CMS Requires Healthcare Providers to Have an Emergency Preparedness Plan: What Should Be Included in a Facility's Plan About Emerging Infections

The CMS Emergency Preparedness Rule, at 42 CFR 482.15 for hospitals and its parallel sections for other provider types, requires every Medicare- and Medicaid-participating facility to maintain an emergency preparedness plan, and that plan must address emerging infectious diseases as a distinct hazard rather than a footnote to generic disaster planning. The binding obligations sit in the rule's risk assessment, policies and procedures, communication, and training provisions. What CMS does not do is hand you a template. It tells you the plan must be "based on" an all-hazards risk assessment and must include "emergency communications plans" and infection-control procedures — the specific content about a novel pathogen is left to the facility to build and defend at survey.

That gap is where most plans fail. A plan that names "pandemic influenza" in a binder and then describes evacuation routes does not satisfy a surveyor asking how the facility would cohort patients during a novel respiratory outbreak with no available rapid test. The sections below break down what the rule actually requires, where emerging infections create obligations the boilerplate misses, and how to write content that survives both a real outbreak and a CMS survey.

What the CoPs Actually Require in the Plan's Four Core Elements

The emergency preparedness Conditions of Participation rest on four elements: an emergency plan, policies and procedures, a communication plan, and training and testing. For hospitals, the plan requirement lives at 42 CFR 482.15(a); critical access hospitals follow 42 CFR 485.625, and the same four-element structure repeats across long-term care, home health, and ambulatory surgical center CoPs. CMS published its final rule in September 2016 and has since issued interpretive guidance through the State Operations Manual, Appendix Z, which surveyors use to score compliance.

Read the plan requirement literally. The facility must base its plan on an all-hazards risk assessment using an "all-hazards approach," which CMS defines as addressing emergencies likely to affect the facility, its patients, and its community. Emerging infectious disease qualifies as a hazard under that definition, and CMS's interpretive guidance explicitly lists "emerging infectious diseases" among the hazards a facility should consider. A plan that assesses wildfire and hurricane risk but never names a novel pathogen is incomplete on its face.

The risk assessment must be documented, reviewed annually, and updated when the facility's circumstances change — a new unit, a new patient population, a new community hazard. That annual review is the hinge for emerging infections, because the hazard landscape for infectious disease shifts faster than for earthquakes. A facility that last revised its infectious disease assumptions before 2020 and has not touched them since is carrying a stale assessment.

One more structural point that catches facilities: the plan must address the facility's "continuity of operations," which CMS interprets to include succession planning for key leadership and delegation of authority during an emergency. During an emerging infection, the medical director, infection preventionist, and nursing leadership may all be quarantined or ill simultaneously. Naming who assumes infection-control decision authority in that scenario belongs in the plan, not in an unwritten understanding.

The Risk Assessment Is Where Emerging Infections Earn Their Specificity

Most risk assessments use a grid of likelihood and impact, and most fill it in with weather and utility failures. Emerging infections need their own row because their defining feature — uncertainty — changes how you score them. A novel pathogen at the start of an outbreak has unknown transmissibility and unknown severity, so likelihood and impact scores that look moderate in week one may be catastrophic by week six. Write the assessment so it documents the assumptions behind the score, not just the number.

CMS does not mandate a scoring method, so facilities commonly use a hazard vulnerability analysis adapted from Kaiser Permanente's tool or a similar framework. Whatever you use, record the date of the assessment and the sources consulted — local health department hazard analyses, state epidemiologic profiles, and CDC surveillance categories are the usual references. A surveyor who sees an undated HVA cannot verify the annual review requirement.

Score emerging infections on at least two axes: the facility's own exposure (patient population, geography, referral patterns, travel-linked admissions) and its surge capacity. A rural critical access hospital with twelve beds and no negative-pressure room faces a different emerging-infection profile than an urban tertiary center with an isolation unit, and the assessment should say so in words. The interpretive guidance permits facilities to use a community-based risk assessment published by a local authority, which saves small facilities the work of building one from scratch.

Update the row when a novel pathogen appears, not just at the annual anniversary. CMS's guidance on "review and update" contemplates changes in facility circumstances; a declared public health emergency affecting the facility's service area is a reasonable trigger to revisit the assessment and document why. That dated annotation is your evidence of a living document.

Policies and Procedures Must Name the Infection-Specific Controls

The procedures requirement at 42 CFR 482.15(b) asks for policies and procedures "based on" the emergency plan, and CMS's interpretive guidance says these must address, among other things, isolation and quarantine, personal protective equipment, and decontamination. For emerging infections, the plan should cross-reference the facility's infection prevention and control program rather than duplicate it, because the CoPs at 42 CFR 482.42 already impose an antibiotic stewardship and infection-control program obligation on hospitals. The emergency plan's job is to describe how those normal controls scale up under emergency conditions.

Write the procedures so they answer operational questions a staff member would actually ask at 2 a.m. Who authorizes moving a patient to a cohort unit? Who decides when a unit converts to negative pressure? What is the process for fitting and stockpiling N95 respirators, and what happens when the supply runs short? CMS does not specify these answers, which means the facility's own policy is the standard a surveyor will measure against — an inconsistency between the written policy and observed practice is a deficiency.

Address the supply-chain edge case explicitly. Emerging infections strain PPE and medication supply in ways routine operations do not, and the plan should describe the facility's approach to conservation, reuse where permitted by applicable standards, and requesting supply from the Strategic National Stockpile through the state health department. The facility does not control the stockpile, but it should name the request pathway and the contact. That is exactly the kind of named, verifiable detail a surveyor can check.

Build in a trigger for activating the procedures. The plan should identify a decision point — for example, when the local health department confirms community transmission of a novel pathogen, or when the facility admits a patient under investigation — and name who makes the activation call. Vague language like "as appropriate" invites inconsistent implementation. A dated activation log, even a simple one maintained by the incident commander, becomes part of the facility's documentation.

Communication Plans Need Public Health, Transport, and Family Channels

The communication plan requirement at 42 CFR 482.15(c) has a specific list: contact information for staff, entities providing services under arrangement, patients' physicians, other hospitals, volunteers, and relevant public health departments. CMS's guidance also calls for a means of sharing information with patients and families. During an emerging infection, all of these channels get tested at once, and the plan should describe how the facility reaches each group when normal phone lines are overloaded and staff are out sick.

Name the public health contacts by role and include backup names. The plan should identify the local health department, the state health department, and the state epidemiologist's after-hours line, and it should record when those contacts were last verified. Contact lists rot quickly; a quarterly verification date written next to the list is defensible evidence and a practical safeguard.

Describe how the facility will communicate with receiving facilities during a transfer. Emerging infections often require transferring a patient to a higher level of care, and the communication plan should specify what clinical and exposure information travels with the patient and through what channel. If the facility uses a regional transfer center, name it. The same logic applies to EMS and interfacility transport: the plan should note what the facility tells transport crews about a suspected infection before they enter the building.

CMS's guidance also expects the communication plan to address how the facility shares information with patients and families, including those who cannot visit. During an outbreak with visitor restrictions, that obligation intensifies. The plan should name the mechanism — a designated family liaison, a scheduled call schedule, or a secure portal — and the person responsible for activating it. An unstaffed channel is not a communication plan.

Training and Testing Have to Include the Infection Scenario

The training and testing requirements at 42 CFR 482.15(d) and (e) obligate hospitals to train all staff on the plan and to conduct testing exercises. CMS's guidance permits two exercise options per year, one of which may be an actual emergency response or a tabletop, and the facility must document the exercise, the participants, and the after-action review. For emerging infections, a tabletop that walks through a novel pathogen scenario will surface gaps in the plan that a fire drill never touches.

Count who needs training. CMS's guidance says training must cover all staff, and that includes contractors and volunteers who work in patient-care areas. For an infection scenario, the training content should include donning and doffing PPE under observation and the facility's process for reporting exposures. A plan that names PPE procedures but never trains staff to them has a documentation gap a surveyor can find.

The after-action review is where the real work happens. CMS expects the facility to evaluate the exercise and revise the plan, and the interpretive guidance emphasizes correcting deficiencies. Write the review so it produces dated, assigned corrective actions, and keep that record with the exercise documentation. When an actual emerging-infection event occurs, the plan's activation log and the after-action review of that event serve as evidence the facility's program functions.

Testing frequency depends on the provider type — hospitals must test twice a year, with at least one exercise community-based or facility-based, and the interpretive guidance allows flexibility in what counts. Check the specific CoP section for your provider type before finalizing your exercise calendar, because the requirements for long-term care and home health differ in detail even though the four-element structure is shared.

Isolation, Cohorting, and Surge Capacity Belong in Writing

The plan should describe how the facility will isolate and cohort patients during an outbreak, and CMS's guidance lists isolation and quarantine among the procedures to address. That means stating the physical spaces involved, the criteria for using them, and the authority to convert space. A facility that plans to cohort in a wing that is normally a rehabilitation gym should say so in writing, describe how the gym's equipment is protected or removed, and note the staffing implications.

Surge capacity is the harder half. Emerging infections can shrink usable bed capacity even as patient volume rises, because isolation rooms are limited and staff may be absent. The plan should describe the facility's approach to expanding capacity — canceling elective procedures, discharging eligible patients, converting observation space — and should name the trigger and the decision-maker. CMS's interpretive guidance ties surge planning to the facility's continuity of operations, so the two sections should reference each other.

Workforce protection deserves its own paragraph. The plan should address what happens when staff are exposed or become ill, including monitoring, return-to-work criteria, and the use of a labor pool or reassignment. CDC's infection-control guidance for healthcare personnel is the usual reference point, and the plan should say it follows current CDC guidance rather than restating it — that keeps the plan current when CDC updates recommendations.

Name the person who owns the isolation and cohorting decisions during an event. In many facilities this is the infection preventionist, but the plan should also name a backup and should describe how the medical director or incident commander participates. A role without a name is a gap on the day the person holding it is unavailable.

Staffing, Supplies, and Mortuary Planning for a Sustained Outbreak

Emerging infections can persist for weeks, which distinguishes them from most disasters the emergency plan covers. That duration changes the staffing calculus: the plan should describe how the facility maintains adequate staffing across a sustained event, including the use of cross-trained staff, modified schedules, and mutual aid arrangements. CMS does not prescribe a staffing formula, so the facility's own continuity-of-operations section carries the weight.

Supply planning should name the categories the facility will track and the thresholds that trigger action. For an infection event, that means PPE, hand hygiene products, disinfectants effective against the pathogen in question, and any medication the facility would need to treat or support patients. The plan should reference how the facility determines the appropriate disinfectant for a novel pathogen — usually by checking the EPA's list of registered antimicrobial products — and should not hard-code a single product name that may change.

Mortuary and fatality management is the section most plans omit. CMS's guidance on emergency preparedness does not dwell on it, but a sustained outbreak can produce fatalities that exceed the facility's normal capacity, and the plan should name the facility's process for temporary storage, coordination with the medical examiner or coroner, and communication with families. This is an uncomfortable section to write, which is exactly why it belongs in a document written during calm.

Build a supply table into the plan. A table listing category, unit of measure, current stock, threshold, and responsible role turns a vague commitment into a checkable inventory. The numbers come from the facility's own stock levels, so there is no external figure to import — the plan should be honest about what is on the shelf and what is not.

Documenting the Plan So It Survives Survey and Litigation

CMS surveyors assess the plan against the CoPs and the interpretive guidance, and deficiencies are cited when the facility cannot produce the required documents or when observed practice departs from the written plan. That makes documentation discipline part of compliance. The plan should carry a revision history, signatures of the leadership who approved it, and dated records of the annual review, the exercises, and the corrective actions.

Emerging infections create a particular documentation challenge: guidance changes fast, and a facility that followed yesterday's CDC recommendation may look noncompliant against today's. The plan should state that the facility follows current guidance from CDC and its state health department and should record the date on which infection-control practices were last reviewed against that guidance. That record protects the facility when guidance shifts mid-event.

Survey findings can trigger a plan of correction with deadlines, and the facility should treat a deficiency in emergency preparedness as a signal to review the infection content specifically. CMS's interpretive guidance and the State Operations Manual, Appendix Z, are the public references a surveyor will consult, and a facility preparing for survey can read the same documents. Nothing in the rule is hidden.

Legal exposure runs alongside survey risk. During a sustained outbreak, the plan and the facility's adherence to it may be examined in malpractice or regulatory proceedings. A plan that names specific procedures, assigns specific roles, and records when those procedures were activated is far easier to defend than one that pledges general readiness. That is not a reason to write a plan for lawyers; it is a reason to write one an operator can actually use.

The plan should close with the facility's process for post-event review and revision, naming who convenes the review, what it examines, and how revisions are approved and distributed. CMS's guidance expects the plan to be updated based on exercises and actual events, and a named process makes that expectation checkable. A plan that names its own revision cycle is a living document; one that doesn't is a binder.

Frequently Asked Questions

Does the CMS emergency preparedness rule specifically mention emerging infectious diseases?

CMS's interpretive guidance in State Operations Manual Appendix Z lists emerging infectious diseases among the hazards facilities should consider in an all-hazards risk assessment, though the regulation text itself uses the broader "all-hazards" language. The practical effect is that a facility must assess the hazard, and a surveyor may ask for evidence the assessment covered it. Naming the hazard in the plan is the clearest way to demonstrate compliance. Facilities that skip it risk a deficiency finding on the risk assessment element.

What is the single biggest omission in infection-related emergency plans?

Documentation of the assumptions behind the risk assessment is the most common gap, because facilities score the hazard but never record the source or date behind the score. CMS's annual review requirement is hard to verify without that dated record. A second frequent gap is contact verification for public health departments — lists that were accurate at drafting but stale at survey. Both are inexpensive to fix and both show up in survey findings.

Can a facility satisfy the requirement by referencing CDC guidance instead of writing its own procedures?

A blanket reference to CDC guidance does not satisfy the procedures requirement, because CMS expects facility-specific policies based on the plan. The workable middle ground is a hybrid: the plan states the facility follows current CDC and state health department guidance and then describes the facility-specific operational decisions — who activates, who cohorts, who communicates — that CDC does not make. That structure stays current as guidance changes while remaining facility-specific on the elements CMS measures.

How often must the emergency preparedness plan be reviewed and updated?

The CoPs require an annual review and update, and CMS's interpretive guidance also expects updates when the facility's circumstances change. A new service line, a new patient population, or a declared public health emergency affecting the service area can all justify a documented update. The review should be dated and signed. Facilities that treat the annual date as the only trigger often carry stale infection assumptions for months after a hazard landscape shifts.

What exercise format best tests an emerging infection scenario?

A tabletop exercise that walks leadership through a novel pathogen arriving at the facility tests the plan's decision points — activation authority, cohorting, communication, and supply thresholds — without disrupting operations. CMS's interpretive guidance permits tabletop exercises as one testing option, and the after-action review is what produces the corrective actions a surveyor will look for. Facilities that rotate a tabletop with a full-scale exercise cover both the decision logic and the operational execution.

Does the communication plan need to cover patients' families during visitor restrictions?

Yes. CMS's interpretive guidance calls for sharing information with patients and families, and visitor restrictions during an outbreak make that obligation more demanding, not less. The plan should name the channel — a designated liaison, scheduled calls, or a secure portal — and the person responsible for activating it. An unstaffed or undefined channel is not a communication plan and will not survive scrutiny after an event.

What are the consequences of a deficient emergency preparedness plan at survey?

Deficiencies are cited against the specific CoP element, and the facility must submit a plan of correction with deadlines; failure to correct can affect Medicare participation. The practical consequence during an actual outbreak is worse: gaps in isolation, supply, or communication procedures get discovered under pressure. Facilities should read the same Appendix Z guidance surveyors use, because the standards are public and the preparation path is visible.

This article is general educational information about CMS emergency preparedness requirements and is not legal, compliance, or clinical advice. Facility obligations vary by provider type and state, and the controlling documents are the CoPs at 42 CFR Part 482 and successors plus CMS State Operations Manual Appendix Z; consult a qualified healthcare attorney or compliance professional for your facility's plan. For immediate danger or a mental health crisis, contact local emergency services or a crisis line.