CMS Emergency Preparedness Rule Compliance Program

The CMS Emergency Preparedness Rule requires each Medicare- and Medicaid-participating provider and supplier type to keep an emergency preparedness program, and each type has its own section of the Code of Federal Regulations: 42 CFR 482.15 for hospitals, 483.73 for long-term care, 484.102 for home health, and so on. Integral Healthcare Solutions (IHS) drafts the risk assessment, plan, policies, communication plan, training outline and exercise documents your section calls for, for your emergency coordinator to adopt.

IHS is a consulting firm, not a law firm; this page is not legal advice.

Last updated: November 2026

What is the CMS Emergency Preparedness Rule?

It is a CMS rule that makes an emergency preparedness program a condition of participating in Medicare or Medicaid. The CMS Emergency Preparedness Rule page (last modified June 29, 2026; page opened November 2, 2026) says the requirements apply to all 18 provider and supplier types and that each type has its own regulations: https://www.cms.gov/medicare/health-safety-standards/quality-safety-oversight-emergency-preparedness/emergency-preparedness-rule. The rule took effect November 16, 2016, with compliance due November 15, 2017; a revising final rule followed on September 30, 2019.

The CMS page body does not list the 18 types or their sections. The table lists the 17 sections we opened in the eCFR text current to October 13, 2026 (page opened November 2, 2026); transplant hospitals fall under 482.15(g). We did not reconcile the 17 to CMS's 18; confirm your own section.

The review interval covers the plan, policies and procedures, communication plan and training and testing program. Exercise tiers, as the sections read:

• Tier 1: at least twice per year. One is an annual full-scale exercise that is community-based or, when a community-based exercise is not accessible, an annual individual facility-based functional exercise. The other is an additional annual exercise. Long-term care adds unannounced staff drills using the emergency procedures, and the PRTF section (441.184) and the hospice inpatient paragraph (418.113(d)(3)) say "twice per year" without "at least."
• Tier 2: at least annually, with a full-scale community-based exercise every 2 years (or, when a community-based exercise is not accessible, a facility-based functional exercise every 2 years) and an additional exercise every 2 years, in the opposite year.
• Tier 3: a paper-based tabletop exercise at least annually (the OPO section adds "or workshop"), with no full-scale exercise.

Sixteen of the 17 sections exempt a facility that activates its plan for an actual emergency from its next required exercise of the kind named. The ICF/IID section also requires the evacuation drills and training at 42 CFR 483.470(i), which we did not open.

What does the hospital section require?

The hospital section, 42 CFR 482.15, requires a comprehensive program that uses an all-hazards approach.

• Plan, paragraph (a): reviewed and updated at least every 2 years, based on a documented facility-based and community-based risk assessment.
• Policies and procedures, paragraph (b), and communication plan, paragraph (c): eight policy topics, including subsistence needs for staff and patients whether they evacuate or shelter in place, plus contact lists and primary and alternate means of communication.
• Training and testing, paragraph (d): initial training consistent with each person's expected role, training at least every 2 years, new training if the policies and procedures are significantly updated, and the tier 1 exercises.
• Power, paragraph (e): a hospital that maintains an onsite fuel source for emergency generators must have a plan to keep emergency power systems operational during the emergency, unless it evacuates.

Paragraph (f) lets a hospital that is part of a system of separately certified healthcare facilities join the system's unified program, and paragraph (g) adds duties for a hospital with a transplant program.

Who needs it and what triggers it?

Every provider and supplier type with its own emergency preparedness section needs a program, because CMS says compliance is required to participate in Medicare or Medicaid.

In IHS's reading, these events start a build:

• A review date is near, or the exercise records do not show the tier your section sets.
• A new site, a new service line, an ownership change or a change of provider type, such as a hospital converting to a rural emergency hospital, which has its own section at 485.542.

How IHS helps

IHS runs five steps: a gap assessment of your documents against your section; a map of the evidence you hold; drafting of missing documents; a mock review against the same section text; and readiness support.

IHS drafts an all-hazards risk assessment worksheet for you to complete, the plan, policies and procedures, a communication plan with contact tables, a training outline, an exercise plan and after-action form, and a review calendar set to your section's interval. You supply hazard, community and population data, contact and power details, the exercises themselves, and sign-off by your emergency coordinator.

The real limit: IHS writes documents. IHS does not run exercises or verify generators or supplies, and does not communicate with CMS or a state survey agency for you. Your organization submits and answers anything an agency asks.

IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. This program sits in IHS's compliance services practice line.

What to have ready

1. Your provider or supplier type and its section (CMS page; the table above).
2. If you are Medicaid-only, the State Medicaid Agency's answer on whether the rule applies (CMS page).
3. Your current plan and the date it was last reviewed (paragraph (a)).
4. Any existing risk assessment, plus local hazard and population data (paragraph (a)(1)).
5. Your policies and procedures and communication plan (paragraphs (b) and (c)).
6. Your training and testing program, training records and the date of its last review (paragraph (d)).
7. Exercise records showing which tier they meet, with the analysis of each (paragraph (d)(2)).
8. For a hospital or critical access hospital, generator inspection and test records and any onsite fuel plan (paragraph (e)).
9. The emergency coordinator who will sign off.

The free introductory call is where IHS learns what you have.

How it compares

The CMS program audit of Medicare Advantage and Part D sponsors is a different matter, with different governing text (42 CFR Parts 422 and 423 and the audit protocols) and a different buyer; see CMS program audit readiness. A hospital converting to a rural emergency hospital is a separate project; see rural emergency hospital conversion. Other programs IHS builds are under compliance services.

This page covers the federal sections only, not state licensure rules or accreditor standards.

What does a CMS emergency preparedness program cost?

The pages we opened state no government fee for adopting an emergency preparedness program. IHS does not publish a price for this work and scopes each engagement after a free introductory call. In IHS's reading, scope moves with the number of facilities and provider types, whether a current risk assessment exists and how many documents need rewriting.

What this is not

• It is not legal advice. IHS is a consulting firm, not a law firm.
• It is not a drill, a generator or supply inspection, or a substitute for your own exercise.
• It is not a guarantee about a survey result, and IHS does not submit anything to or communicate with CMS or a state survey agency for you.

Frequently asked questions

What is the CMS Emergency Preparedness Rule?

It is a CMS rule that requires providers and suppliers to keep an emergency preparedness program as a condition of participating in Medicare or Medicaid. The CMS page says it applies to all 18 provider and supplier types.

Which section applies to my provider type?

Hospitals use 42 CFR 482.15, long-term care facilities 483.73, home health agencies 484.102, ambulatory surgical centers 416.54 and hospices 418.113; the table lists all 17 sections we opened. The CMS page does not list the types, so confirm yours in the eCFR.

How often must the emergency plan be reviewed?

Most sections say the plan, policies and procedures, communication plan and training and testing program must be reviewed and updated at least every 2 years. The long-term care section, 42 CFR 483.73, says at least annually. The dialysis section, 494.62, says evaluated and updated at least every 2 years.

What exercises are required each year?

A hospital under 42 CFR 482.15(d)(2) must conduct exercises at least twice per year: an annual full-scale community-based exercise (or, when a community-based exercise is not accessible, an annual individual facility-based functional exercise) plus an additional annual exercise; it must also analyze and document its response to all drills, tabletop exercises and emergency events. Tier 2 types test at least annually, with the full-scale or functional exercise every 2 years; tier 3 types hold a tabletop at least annually.

What if we activate our plan in a real emergency?

Sixteen of the 17 sections opened say a facility that experiences an actual natural or man-made emergency requiring activation of its plan is exempt from its next required exercise of the kind named, following the onset of the emergency. The hospital text names the next required full-scale community-based or individual facility-based functional exercise. The RNHCI section has no such sentence.

Does the rule apply to a Medicaid-only facility?

For Medicaid-only facilities other than ICF-IIDs and PRTFs, the CMS page tells the facility to contact its State Medicaid Agency to learn whether it must meet the requirements. That contact is the facility's to make; IHS does not make it for you.

Does the rule require the whole Life Safety Code?

Not all of it. The CMS page says the emergency preparedness rule defers to the Fire Safety Final Rule, which excluded chapters 7, 8, 12 and 13, so those chapters are not required by CMS to be met by providers. Separately, 42 CFR 482.15(e) and (h) tie hospital generator location, inspection and testing to NFPA 99, NFPA 101 and NFPA 110 in the editions listed.

A CMS table says hospitals review annually. Which is right?

The current text controls. A CMS overview table by provider type, which we opened, gives hospital review and training as at least annually; the hospital text in the eCFR current to October 13, 2026 says at least every 2 years for both. The table calls itself an overview, not a substitute for the regulatory text, and shows no date; in IHS's reading it predates the 2019 revisions.

Will IHS run our drills or talk to CMS or the state survey agency?

No. IHS writes the exercise plan and after-action form, and your staff run and record the exercise. IHS does not verify generators or supplies and does not communicate with CMS or a state survey agency for you; your organization submits and answers anything the agency asks.