Healthcare emergency preparedness is a comprehensive organizational discipline that touches every department and every aspect of facility management. The COVID-19 pandemic tested emergency preparedness programs across the entire spectrum of healthcare facilities — and revealed significant gaps in programs that had existed on paper but not been exercised adequately.
For healthcare facility directors, emergency preparedness is not an administrative burden — it is a core operational responsibility that intersects with physical plant management, utility system resilience, and the facility’s ability to continue providing care when normal conditions fail.
The Regulatory Framework
Healthcare emergency preparedness is governed by multiple overlapping regulatory requirements:
CMS Emergency Preparedness Rule (42 CFR §482.15) — Effective November 2016, requires all CMS-participating hospitals to have a comprehensive emergency preparedness program with four required elements: risk assessment and planning, policies and procedures, communication plan, and training/testing.
Joint Commission EC.04.01.01 through EC.04.02.03 — The Joint Commission’s emergency management standards align closely with the CMS requirements and require comprehensive planning, HVA, and exercise programs.
The Joint Commission’s Emergency Management chapter — Includes specific standards for both utility emergencies (EM.02.02.01) and community-based events (EM.02.01.01), requiring that hospitals plan for disruptions to utilities, environment, and the care environment.
NIMS/ICS alignment — Both CMS and TJC expect that hospital emergency programs use the National Incident Management System (NIMS) framework and the Incident Command System (ICS), implemented in healthcare as HICS.
Hazard Vulnerability Analysis
The foundation of any healthcare emergency preparedness program is the Hazard Vulnerability Analysis (HVA) — a systematic assessment of the risks the facility faces, their likelihood, and their potential impact.
The Kaiser Permanente HVA tool, widely used in healthcare, scores hazards on three dimensions:
- Probability — How likely is this event to occur? (rated 0–3)
- Magnitude/Severity — How severe would the impact be? (rated 0–3)
- Preparedness — How prepared is the facility? (inverse scale — lower preparedness increases risk score)
The resulting risk score prioritizes hazards for planning attention. A high-probability, high-severity, low-preparedness hazard demands immediate planning investment.
Common hazard categories in healthcare HVAs:
- Natural hazards (flood, earthquake, tornado, winter storm, extreme heat)
- Technological hazards (power failure, utility disruption, IT system failure, hazmat incident)
- Human hazards (mass casualty incident, terrorism, workplace violence, cyber attack)
- Regulatory hazards (loss of accreditation, CMS survey failure)
COVID-19 is now a standard HVA entry for pandemic/epidemic under natural hazards. Post-COVID HVAs should reflect lessons learned from the 2020–2021 experience.
Hospital Incident Command System (HICS)
HICS is the healthcare adaptation of the Incident Command System — the standard organizational structure used by emergency responders. Adopting HICS enables healthcare facilities to communicate and coordinate effectively with emergency management agencies, neighboring hospitals, and mutual aid networks that all use ICS-based structures.
HICS key components:
Incident Commander — Senior leader who has overall operational authority during an emergency. In hospitals, this is often the administrator on call or a designated senior administrator.
Command staff — Safety Officer, Liaison Officer, and Public Information Officer report directly to the Incident Commander and manage cross-functional concerns.
Four section chiefs — Operations, Logistics, Planning, and Finance/Administration sections each manage specific functions during the incident.
Hospital Operations Center (HOC) — The physical or virtual space where command staff coordinate the emergency response. Facility directors are typically involved in the Logistics section (managing physical resources) and potentially the Operations section.
Facility directors should be assigned specific HICS roles in the Emergency Operations Plan and should practice those roles during exercise events.
The Emergency Operations Plan
The Emergency Operations Plan (EOP) is the comprehensive document describing how the facility will respond to and recover from emergencies. CMS requires that the EOP address six specific elements:
- Communication plan — How information flows internally and externally during an emergency
- Patient population tracking — Tracking and transferring patients during incidents
- Medical documentation continuation — Maintaining patient care documentation during system failures
- Volunteer management — Integrating volunteers from community organizations
- Arrangements with other healthcare organizations — Mutual aid and patient transfer agreements
- Alternate care sites — Arrangements for care delivery if the facility must be evacuated or partially evacuated
The EOP should also include facility-specific annexes covering:
- Utility failure (power, water, medical gas, communications)
- HVAC and air quality emergencies
- Mass casualty/surge capacity
- Severe weather protocols
- Active shooter/lockdown
Exercise Requirements
Both CMS and TJC require regular exercises of the emergency preparedness program:
CMS requirements:
- Annual training for all staff
- Annual exercises — at minimum, one functional exercise annually and a tabletop exercise in alternate years; OR two tabletop exercises in one year; OR one full-scale community-based exercise every other year
Joint Commission requirements:
- Two emergency management exercises annually
- At least one exercise must involve actual response to a real community emergency or an escalating-scenario exercise
Documenting and evaluating exercises — Every exercise must be documented, evaluated for performance gaps, and have a corrective action plan for identified deficiencies. Without this documentation cycle, exercises are a compliance event without operational value.
COVID-19 counted as a real emergency event for exercise credit at facilities that activated their EOPs. Post-COVID after-action reviews — systematically documenting what went well and what failed during the actual pandemic response — are among the most valuable emergency preparedness activities a facility can complete.
Utility Continuity Planning
Facility directors have primary responsibility for emergency planning related to utilities — power, water, medical gas, and communications. The Emergency Operations Plan must address:
- Emergency power source capacity and duration
- Potable water supply during a water system failure
- Medical gas contingency during piped system failure (cylinder backup)
- Communications during IT and telephone system failure (radios, satellite phones)
- HVAC contingency for clinical spaces during system failure
Exercise scenarios should include utility failure tabletops to test whether the written plans reflect operational reality.
Frequently Asked Questions
How does the COVID-19 pandemic change our emergency preparedness approach? COVID-19 demonstrated several capabilities that prior emergency preparedness programs had not fully developed: long-duration sustained surge operations (most exercises simulated 72-hour events), respiratory protection procurement and distribution at scale, hospital-wide infection control during surge, workforce protection during sustained operations, and supply chain resilience for critical supplies. Update your HVA, EOP, and training curriculum to reflect these lessons explicitly.
What is the difference between an emergency operations plan and a business continuity plan? The EOP governs response to an emergency event — an acute disruption of normal operations. The Business Continuity Plan (BCP) covers the longer-term recovery of business functions after an event — how the organization resumes normal operations. Healthcare accreditation standards focus primarily on the EOP. However, healthcare organizations increasingly recognize the value of formal business continuity planning for sustained disruptions.
Who should participate in tabletop exercises? Tabletop exercises should include everyone who has a role in the Emergency Operations Plan — senior leadership, department directors, the facilities team, nursing leadership, security, pharmacy, laboratory, and key physicians. The value of tabletops comes from the cross-functional decision-making and communication testing, not from checking an attendance box with the minimum required participants.
How do we incorporate facility infrastructure resilience into emergency planning? Treat infrastructure resilience as a standing agenda item in emergency management committee meetings. Annually review the gap between current utility backup capabilities and the scenarios in your HVA. Develop capital budget requests for infrastructure resilience improvements (extended fuel storage, redundant utility feeds, additional AII room capacity) supported by the emergency planning risk analysis.