Back to EP Home

Appendix Z Core Elements

Explore resources organized by the four core elements of the CMS Emergency Preparedness Rule. Each section includes practical guidance, recommended documentation, and common gaps to watch for when preparing for surveys or strengthening real-world readiness.

Risk Assessment & Emergency Planning

Conduct a facility-based, all-hazards risk assessment and maintain an emergency preparedness plan that reflects the organization’s services, patient population, known risks, and coordination needs.

What “Good” Looks Like

  • Current Hazard Vulnerability Analysis (HVA) or risk assessment
  • Documented planning assumptions and prioritized hazards
  • Emergency preparedness plan aligned to identified risks
  • Leadership review and update evidence
  • Coordination evidence with local/regional partners

Common Gaps to Avoid

  • Outdated or generic HVA
  • Plan not tied to actual risks or services
  • Weak documentation of community coordination
  • No evidence that leadership reviewed or approved updates

Policies & Procedures

Develop operational policies and procedures that support continuity of care, staffing, evacuation or shelter-in-place decision-making, resource management, and patient/resident safety during disruptions.

What “Good” Looks Like

  • Policies aligned to the emergency plan and risk assessment
  • Evacuation and shelter-in-place procedures
  • Continuity of operations / essential services guidance
  • Staffing and resource management strategies
  • Procedures for extended or cascading events

Common Gaps to Avoid

  • Policies do not match the emergency plan
  • Evacuation triggers are unclear
  • Continuity procedures are incomplete
  • Staff roles are not operationally clear

Emergency Communications

Maintain internal and external communication processes that support staff notification, patient/resident communication, coordination with partners, and redundant communication methods during emergencies.

What “Good” Looks Like

  • Current contact lists and role-based call-down procedures
  • Internal notification process
  • External partner communication process
  • Redundant communication methods
  • Procedures for communicating with patients/residents, families, and necessary representatives

Common Gaps to Avoid

  • Stale contact lists
  • No backup communication method
  • Unclear responsibility for notifications
  • Communication plan not tested or updated

Training & Testing Program

Maintain a training and testing program that prepares staff, validates emergency plans, documents exercises, and uses after-action findings to drive improvement

What “Good” Looks Like

  • Initial and ongoing EP training records
  • Exercise plans and participant documentation
  • Tabletop, drill, full-scale, or community-based exercise documentation
  • After-action reports (AARs)
  • Improvement plan tracker with responsible parties and status

Common Gaps to Avoid

  • Exercises conducted without AARs
  • Corrective actions not tracked
  • Training not documented
  • Exercises not linked to actual risks or plan priorities