In the wake of Hurricanes Harvey, Irma and Maria, the November 15, 2017 deadline for new Centers for Medicare and Medicaid Services regulations on emergency preparedness seems all the more critical. Hundreds of facilities were devastated by flooding and damage, leaving them without vital patient data and at risk of security breaches and Health Insurance Portability and Accountability Act violations. Although the government temporarily waived some administrative requirements and HIPAA regulations in Texas and Florida to allow health care organizations to act swiftly to ensure patient safety and resume operations, it’s clear that having an emergency plan in place can make post-disaster recovery smoother for all parties involved.

Whether facing man-made or natural disasters, hospitals, senior living communities and other health care organizations need disaster recovery plans in place to ensure critical electronic data can be restored in a timely manner and operations can continue as needed. Because most health care organizations rely on electronic data to treat patients and share vital information across departments, a loss of Internet, damage to infrastructure or delayed power restoration after a disaster can prove inconvenient at best and deadly at worst.

Seventeen types of providers including hospitals, critical access hospitals, long term care facilities, hospice services, community mental health centers, home health agencies, rural health clinics and federally qualified health centers are covered by the new Rule. Emergency preparedness regulations for the November 15 CMS deadline vary based on provider type. However, four core elements of an Emergency Preparedness Program for all 17 types of providers covered by the new Rule include:

  • Risk Assessment and Emergency Planning
  • Communication Plan
  • Policies and Procedures
  • Training and Testing.

A full spectrum of planning is necessary to determine which data is most critical to operations and how quickly it needs to be restored before patients are at risk. Under the new Emergency Preparedness Rule, covered providers must be in compliance to participate in the Medicare or Medicaid program. Facilities are expected to be in compliance including meeting all training and testing requirements by the November 15, 2017 implementation date.

If you have any questions about preparing your emergency plan before the Nov. 15 deadline, please contact Jennifer Sullivan or Terry Cipoletti, health law attorneys at Caplan and Earnest LLC. They can be reached at 303-443-8010 or by email at [email protected] or [email protected]