CMS Emergency Preparedness Rule — Requirements for Medicare and Medicaid Participating Providers and Suppliers
The CMS Emergency Preparedness Rule sets national requirements for emergency preparedness across 17 Medicare- and Medicaid-participating provider and supplier types. It establishes four core elements every covered facility must address: a risk assessment and emergency plan, emergency preparedness policies and procedures, a communication plan, and a training and testing program. Non-compliance is a condition-level deficiency and can result in termination from Medicare and Medicaid programs.
Last reviewed: April 2026 | Source: eCFR, 42 CFR (multiple parts); CMS Appendix Z
Quick Reference — The Four Core Elements
Every covered provider and supplier must maintain a comprehensive emergency preparedness program built around four core elements:
| # | Core Element | What It Requires |
|---|---|---|
| 1 | Risk Assessment and Emergency Plan | Documented, facility- and community-based risk assessment using an all-hazards approach, with a written emergency plan built from that assessment. |
| 2 | Policies and Procedures | Written policies and procedures based on the emergency plan, risk assessment, and communication plan. Reviewed every two years (annually for long-term care). |
| 3 | Communication Plan | Written plan for communicating with staff, patients, family, physicians, other facilities, and emergency officials. Complies with federal, state, and local laws. |
| 4 | Training and Testing Program | Initial and ongoing staff training, plus annual testing exercises (cadence and type vary by inpatient vs. outpatient status). |
The four elements apply to all 17 covered provider and supplier types. Specific requirements vary based on whether the facility is inpatient or outpatient, and whether it is a long-term care facility.
Applicability — Who Must Comply
The CMS Emergency Preparedness Rule applies to 17 provider and supplier types participating in Medicare or Medicaid. Each provider type has its own citation within Title 42 of the Code of Federal Regulations, but the four core elements are substantively the same across all 17 types. Variations exist based on inpatient versus outpatient status and long-term care versus non-long-term care.
The practical threshold is Medicare or Medicaid participation:
If your facility is certified to participate in Medicare or Medicaid as one of the 17 covered provider or supplier types, the CMS Emergency Preparedness Rule applies. Compliance is required to receive Medicare or Medicaid reimbursement.
Single- and multi-specialty medical group practices, physician offices, fire and rescue units, and ambulance services are not covered by the EP Rule. These entities may participate in a covered facility’s emergency preparedness plan but are not themselves subject to the rule.
The 17 Covered Provider and Supplier Types
The table below lists every covered provider and supplier type with its corresponding CFR citation. The substantive requirements are the same across all 17 types, with variations noted in the core requirements section.
| Provider / Supplier Type | CFR Citation |
|---|---|
| Religious Nonmedical Health Care Institutions (RNHCIs) | 42 CFR 403.748 |
| Ambulatory Surgical Centers (ASCs) | 42 CFR 416.54 |
| Hospices | 42 CFR 418.113 |
| Psychiatric Residential Treatment Facilities (PRTFs) | 42 CFR 441.184 |
| Programs of All-Inclusive Care for the Elderly (PACE) | 42 CFR 460.84 |
| Hospitals | 42 CFR 482.15 |
| Transplant Centers | 42 CFR 482.78 |
| Long-Term Care (LTC) Facilities | 42 CFR 483.73 |
| Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID) | 42 CFR 483.475 |
| Home Health Agencies (HHAs) | 42 CFR 484.102 |
| Comprehensive Outpatient Rehabilitation Facilities (CORFs) | 42 CFR 485.68 |
| Critical Access Hospitals (CAHs) | 42 CFR 485.625 |
| Clinics, Rehabilitation Agencies, and Public Health Agencies (Outpatient PT and Speech-Language Pathology) | 42 CFR 485.727 |
| Community Mental Health Centers (CMHCs) | 42 CFR 485.920 |
| Organ Procurement Organizations (OPOs) | 42 CFR 486.360 |
| Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) | 42 CFR 491.12 |
| End-Stage Renal Disease (ESRD) Facilities | 42 CFR 494.62 |
The Four Core Elements
Each of the four core elements has detailed substantive requirements specified in the CFR. The elements below summarize what each requires at a facility level. “Facility” is used generically to refer to any of the 17 covered provider or supplier types; the specific regulation for each type will use the specific provider/supplier term.
Element 1 — Risk Assessment and Emergency Plan
The facility must develop and maintain a written emergency preparedness plan that is reviewed and updated at least every two years. For long-term care facilities, the review and update cadence is at least annually. The plan must:
- Be based on and include a documented, facility-based and community-based risk assessment using an all-hazards approach.
- Include strategies for addressing each emergency event identified by the risk assessment.
- Address the patient or resident population served, including persons at risk; the types of services the facility can provide during an emergency; and continuity of operations, including delegations of authority and succession plans.
- Include a process for cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials to ensure an integrated response during a disaster or emergency.
An all-hazards approach means the risk assessment considers the full range of threats the facility could face — including natural disasters, infectious disease outbreaks, cyber attacks, utility failures, supply chain disruptions, and acts of violence — rather than planning for each threat in isolation.
Element 2 — Policies and Procedures
The facility must develop and implement written emergency preparedness policies and procedures based on the emergency plan, the risk assessment, and the communication plan. Policies and procedures must be reviewed and updated at least every two years (annually for long-term care). At a minimum, they must address:
- Provision of subsistence needs for staff and patients whether they evacuate or shelter in place — food, water, medical and pharmaceutical supplies, and alternate sources of energy to maintain temperatures and essential systems. Outpatient facilities are not required to address subsistence needs.
- A system to track the location of on-duty staff and sheltered patients during an emergency.
- Safe evacuation, including consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation locations; and primary and alternate means of communication with external sources of assistance.
- A means to shelter in place for patients, staff, and volunteers who remain in the facility.
- A system of medical documentation that preserves patient information, protects confidentiality, and secures records in a format that is usable and accessible.
- Use of volunteers in an emergency, including any planned role of state or federally designated health care professionals to address surge needs.
- Arrangements with other facilities to receive patients in the event of limitations or cessation of operations.
Element 3 — Communication Plan
The facility must develop and maintain an emergency preparedness communication plan that complies with federal, state, and local laws. The plan must be reviewed and updated at least every two years (annually for long-term care). The communication plan must include:
- Names and contact information for staff, entities providing services under arrangement, patients’ physicians, other facilities, and volunteers.
- Contact information for federal, state, tribal, regional, and local emergency preparedness staff and other sources of assistance.
- Primary and alternate means of communicating with facility staff and with federal, state, tribal, regional, and local emergency management agencies.
- A method for sharing information and medical documentation for patients under the facility’s care with other health care providers to maintain continuity of care.
- A means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510(b)(1)(ii).
- A means of providing information about the general condition and location of patients as permitted under 45 CFR 164.510(b)(4).
- A means of providing information about the facility’s occupancy, needs, and ability to provide assistance to the authority having jurisdiction, the Incident Command Center, or a designee.
Element 4 — Training and Testing Program
The facility must develop and maintain an emergency preparedness training and testing program based on the emergency plan, risk assessment, policies and procedures, and communication plan. The program must be reviewed and updated at least every two years (annually for long-term care).
Training requirements:
- Provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers — consistent with their expected role.
- After initial training, provide emergency preparedness training at least every two years. Long-term care facilities must provide training at least annually.
- Demonstrate staff knowledge of emergency procedures.
- Maintain documentation of all emergency preparedness training.
- If emergency preparedness policies and procedures are significantly updated, conduct training on the updated policies and procedures.
Testing requirements — inpatient providers and suppliers:
- Conduct two testing exercises per year.
- One must be a full-scale exercise that is community-based. If a community-based exercise is not accessible, conduct an individual, facility-based functional exercise.
- The other may be an exercise of the facility’s choice — a second full-scale or facility-based functional exercise, a mock disaster drill, or a tabletop exercise that includes a group discussion led by a facilitator.
Testing requirements — outpatient providers and suppliers:
- Conduct one testing exercise per year.
- In alternating years, the exercise must be either a community-based full-scale exercise (if available) or an individual, facility-based functional exercise.
- In the opposite year, conduct an exercise of the facility’s choice — a drill, tabletop, or additional full-scale or functional exercise.
Actual-event exemption:
If the facility experiences an actual natural or man-made emergency that requires activation of its emergency plan, it is exempt from the next required full-scale community-based or facility-based functional exercise following the event. The facility must maintain written documentation demonstrating activation. The exemption applies only to the full-scale/functional exercise requirement — the exercise of choice is still required on its regular cadence.
Additional Operational Requirements
In addition to the four core elements, the EP Rule specifies several operational requirements that apply across provider types with variations based on inpatient versus outpatient status.
Integrated Healthcare Systems
A facility that is part of a healthcare system consisting of multiple separately certified facilities may elect to participate in the healthcare system’s unified and integrated emergency preparedness program. If it does, the system-wide program must demonstrate that each separately certified facility actively participated in its development, that the program is updated to reflect changes within the system, and that each facility can demonstrate compliance with each required element.
Emergency and Standby Power Systems (Inpatient Facilities)
Hospitals, critical access hospitals, and long-term care facilities must implement emergency and standby power systems that meet the requirements of the applicable condition of participation and the plan’s identified hazards. These systems must be based on the facility’s risk assessment and must maintain temperatures to protect patient health and safety and preserve the safe and sanitary storage of provisions.
Coordination With Emergency Preparedness Officials
The facility must include a process for cooperation and collaboration with local, tribal, regional, state, or federal emergency preparedness officials in its emergency plan. As revised by the 2019 Burden Reduction Rule, facilities are no longer required to document specific efforts to contact these officials or document participation in collaborative planning. Coordination is still required; the documentation burden is reduced.
Review and Update Requirements
The EP Rule establishes minimum review cadences for the emergency program and each of its component documents. Reviews must occur on the cadence below and whenever substantive changes to operations, risks, or regulatory requirements warrant an earlier update.
| Document / Program Element | Most Providers | Long-Term Care |
|---|---|---|
| Emergency plan | Every 2 years | Annually |
| Policies and procedures | Every 2 years | Annually |
| Communication plan | Every 2 years | Annually |
| Training and testing program | Every 2 years | Annually |
| Staff training | Every 2 years after initial | Annually after initial |
| Testing exercises — inpatient | 2 per year | 2 per year |
| Testing exercises — outpatient | 1 per year | N/A |
The review cadence is continuous. Any substantive change in operations, staffing, patient population, physical plant, or regulatory environment should trigger a review and update ahead of the scheduled cadence. Reviews must be documented to withstand surveyor scrutiny.
What the EP Rule Does Not Require
The 2019 Burden Reduction Rule clarified several areas where the EP Rule does not impose requirements that are sometimes assumed. Specifically, the rule does not require:
- Documentation of specific efforts to contact local, tribal, regional, state, or federal emergency preparedness officials. Coordination is still required; the documentation burden was eliminated in 2019.
- Documentation of participation in collaborative and cooperative planning efforts with external agencies. Participation remains encouraged; the documentation requirement was eliminated in 2019.
- A specific format for the emergency preparedness program. Facilities may maintain documentation in paper, electronic, or any other format, provided they can demonstrate the program in writing.
- Coverage of providers and suppliers outside the 17 covered types. Physician offices, single- and multi-specialty medical groups, ambulance services, and fire and rescue units are not covered by the EP Rule, though they may participate in a covered facility’s program.
- A specific number of annual reviews beyond the stated biennial (or annual, for LTC) minimum. Facilities may review more frequently at their discretion.
Enforcement and Penalties
CMS enforces the EP Rule through the survey and certification process conducted by state survey agencies and CMS-approved accreditation organizations. An EP Rule deficiency is cited at the condition level when the facility fails to meet the overall requirements of the condition of participation, rather than at the standard level. Condition-level deficiencies carry the most serious enforcement consequences.
How Deficiencies Are Cited
Survey findings are categorized by severity:
- Standard-level deficiency — failure to meet a specific standard within a condition. Typically resolvable through a plan of correction.
- Condition-level deficiency — failure so substantial that the facility does not meet the overall condition of participation. Can result in termination from Medicare and Medicaid.
EP Rule citations are commonly issued at the condition level when multiple standards within the condition are deficient, or when a single deficiency substantially limits the facility’s ability to deliver safe care during an emergency.
Consequences of Non-Compliance
A condition-level deficiency can result in:
- A plan of correction requirement with a specified timeframe, commonly 60 days.
- Denial of Medicare or Medicaid payments for new admissions during the correction period.
- Termination of the facility’s Medicare or Medicaid provider agreement if the deficiency is not corrected within the specified timeframe.
- Civil monetary penalties, particularly for long-term care facilities, under applicable enforcement frameworks.
Termination from Medicare and Medicaid participation is the most severe consequence and is effectively a business-ending event for most covered facilities, as Medicare and Medicaid typically account for a substantial portion of facility revenue. Even short of termination, denial of payment for new admissions during a correction period creates immediate operational and financial pressure. Surveys are unannounced and occur on a cycle determined by CMS — typically every three years for hospitals and more frequently for long-term care facilities.
Source
Primary source: 42 CFR Parts 403, 416, 418, 441, 460, 482, 483, 484, 485, 486, 491, and 494. U.S. Centers for Medicare & Medicaid Services; U.S. Department of Health and Human Services. Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers (81 FR 63860, September 16, 2016); revised by the Omnibus Burden Reduction Rule (84 FR 51732, September 30, 2019).
Interpretive guidance: CMS State Operations Manual, Appendix Z — Emergency Preparedness for All Provider and Certified Supplier Types. Accessible via the Electronic Code of Federal Regulations at eCFR.gov (opens in new tab).
Related Regulatory References
- OSHA 29 CFR 1910.38 — Emergency Action Plans. Federal OSHA requirements for written emergency action plans. Covers any employer with 11 or more employees — applies alongside the CMS EP Rule for healthcare facilities.
- Joint Commission Emergency Management Standards — Voluntary accreditation standards that, in many cases, meet or exceed CMS EP Rule requirements. Joint Commission-accredited facilities may be deemed in compliance with the EP Rule condition of participation.
- Texas Health and Safety Code Chapter 331 — Texas-specific workplace violence prevention requirements for healthcare facilities. Applies alongside federal requirements in AOG’s primary operating region.
Document Control
Last reviewed: April 2026 | Last revised: April 2026 | Page owner: AOG Operations Group