Medicare and Medicaid Programs; Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule.

SUMMARY:

This final rule establishes national emergency preparedness requirements for Medicare- and Medicaid-participating providers and suppliers to plan adequately for both natural and man-made disasters, and coordinate with federal, state, tribal, regional, and local emergency preparedness systems. It will also assist providers and suppliers to adequately prepare to meet the needs of patients, residents, clients, and participants during disasters and emergency situations. Despite some variations, our regulations will provide consistent emergency preparedness requirements, enhance patient safety during emergencies for persons served by Medicare- and Medicaid-participating facilities, and establish a more coordinated and defined response to natural and man-made disasters.

DATES:

Effective date: These regulations are effective on November 15, 2016.

Incorporation by reference: The incorporation by reference of certain publications listed in the rule is approved by the Director of the Federal Register November 15, 2016.

Implementation date: These regulations must be implemented by November 15, 2017.

FOR FURTHER INFORMATION CONTACT:

Janice Graham, (410) 786-8020.

Mary Collins, (410) 786-3189.

Diane Corning, (410) 786-8486.

Kianna Banks (410) 786-3498.

Ronisha Blackstone, (410) 786-6882.

Alpha-Banu Huq, (410) 786-8687.

Lisa Parker, (410) 786-4665.

SUPPLEMENTARY INFORMATION:

Acronyms

AAAHC Accreditation Association for Ambulatory Health Care, Inc.

AAAASF American Association for Accreditation for Ambulatory Surgery Facilities, Inc.

AAR/IP After Action Report/Improvement Plan

ACHC Accreditation Commission for Health Care, Inc.

ACHE American College of Healthcare Executives

AHA American Hospital Association

AO Accrediting Organization

AOA/HFAP American Osteopathic Association/Healthcare Facilities Accreditation Program

ASC Ambulatory Surgical Center

ARCAH Accreditation Requirements for Critical Access Hospitals

ASPR Assistant Secretary for Preparedness and Response

BLS Bureau of Labor Statistics

BTCDP Bioterrorism Training and Curriculum Development Program

CAH Critical Access Hospital

CAMCAH Comprehensive Accreditation Manual for Critical Access Hospitals

CAMH Comprehensive Accreditation Manual for Hospitals

CASPER Certification and the Survey Provider Enhanced Reporting

CDC Centers for Disease Control and Prevention

CON Certificate of Need

CfCs Conditions for Coverage and Conditions for Certification

CHAP Community Health Accreditation Program

CMHC Community Mental Health Center

CMS Centers for Medicare and Medicaid Services

COI Collection of Information

CoPs Conditions of Participation

CORF Comprehensive Outpatient Rehabilitation Facilities

CPHP Centers for Public Health Preparedness

CRI Cities Readiness Initiative

DHS  Department of Homeland Security

DHHS Department of Health and Human Services

DNV GL Det Norske Veritas GL—Healthcare

DOL Department of Labor

DPU Distinct Part Units

DSA Donation Service Area

EOP Emergency Operations Plans

EC Environment of Care

EMP Emergency Management Plan

EP Emergency Preparedness

ESAR-VHP Emergency System for Advance Registration of Volunteer Health Professionals

ESF Emergency Support Function

ESRD End-Stage Renal Disease

FEMA Federal Emergency Management Agency

FDA Food and Drug Administration

FORHP Federal Office of Rural Health Policy

FRI Federal Reserve Inventories

FQHC Federally Qualified Health Center

GAO Government Accountability Office

HFAP Healthcare Facilities Accreditation Program

HHA Home Health Agencies

HPP Hospital Preparedness Program

HRSA Health Resources and Services Administration

HSC Homeland Security Council

HSEEP Homeland Security Exercise and Evaluation Program

HSPD Homeland Security Presidential Directive

HVA Hazard Vulnerability Analysis or Assessment

ICFs/IID Intermediate Care Facilities for Individuals with Intellectual Disabilities

ICR Information Collection Requirements

IDG Interdisciplinary Group

IOM Institute of Medicine

JPATS Joint Patient Assessment and Tracking System

LEP Limited English Proficiency

LD Leadership

LPHA Local Public Health Agencies

LSC Life Safety Code

LTC Long Term Care

MMRS Metropolitan Medical Response System

MRC Medical Reserve Corps

MS Medical Staff

NDMS National Disaster Medical System

NFs Nursing Facilities

NFPA National Fire Protection Association

NIMS National Incident Management System

NIOSH National Institute for Occupational Safety and Health

NLTN National Laboratory Training Network

NRP National Response Plan

NRF National Response Framework

NSS National Security Staff

OBRA Omnibus Budget Reconciliation Act

OIG Office of the Inspector General

OPHPR Office of Public Health Preparedness and Response

OPO Organ Procurement Organization

OPT Outpatient Physical Therapy

OPTN Organ Procurement and Transplantation Network

OSHA Occupational Safety and Health Administration

PACE Program for the All-Inclusive Care for the Elderly

PAHPA Pandemic and All-Hazards Preparedness Act

PAHPRA Pandemic and All-Hazards Preparedness Reauthorization Act

PCT Patient Care Technician

PPE Personal Protection Equipment

PHEP Public Health Emergency Preparedness

PHS Act Public Health Service Act

PIN Policy Information Notice

PPD Presidential Policy Directive

PRTF Psychiatric Residential Treatment Facilities

QAPI Quality Assessment and Performance Improvement

QIES Quality Improvement and Evaluation System

RFA Regulatory Flexibility Act

RNHCIs Religious Nonmedical Health Care Institutions

RHC Rural Health Clinic

SAMHSA Substance Abuse and Mental Health Services Administration

SLP Speech Language Pathology

SNF Skilled Nursing Facility

SNS Strategic National Stockpile

TEFRA Tax Equity and Fiscal Responsibility Act

TFAH Trust for America's Health

TJC The Joint Commission

TRACIE Technical Resources, Assistance Center, and Information Exchange

TTX Tabletop Exercise

UMRA Unfunded Mandates Reform Act

UNOS United Network for Organ Sharing

UPMC University of Pittsburgh Medical Center

WHO World Health Organization

Table of Contents

I. Overview

A. Executive Summary

1. Purpose

2. Summary of the Major Provisions

B. Current State of Emergency Preparedness

C. Statutory and Regulatory Background

II. Provisions of the Proposed Rule and Responses to Public Comments

A. General Comments

1. Integrated Health Systems

2. Requests for Technical Assistance and Funding

3. Requirement To Track Patients and Staff

B. Implementation Date

C. Emergency Preparedness Regulations for Hospitals (§ 482.15)

1. Risk Assessment and Emergency Plan (§ 482.15(a))

2. Policies and Procedures (§ 482.15(b)

3. Communication Plan (§ 482.15(c)

4. Training and Testing (§ 482.15(d)

5. Emergency Fuel and Generator Testing (§ 482.15(e)

D. Emergency Preparedness Regulations for Religious Nonmedical Health Care Institutions (RNHCIs) (§ 403.748)

E. Emergency Preparedness Regulations for Ambulatory Surgical Centers (ASCs) (§ 416.54)

F. Emergency Preparedness Regulations for Hospices (§ 418.113)

G. Emergency Preparedness Regulations for Psychiatric Residential Treatment Facilities (PRTFs) (§ 441.184)

H. Emergency Preparedness Regulations for Programs of All-Inclusive Care for the Elderly (PACE) (§ 460.84)

I. Emergency Preparedness Regulations for Transplant Centers (§ 482.78)

J. Emergency Preparedness Regulations for Long-Term Care (LTC) Facilities (§ 483.73)

K. Emergency Preparedness Regulations for Intermediate Care Facilities for Individuals With Intellectual Disabilities (ICF/IID) (§ 483.475)

L. Emergency Preparedness Regulations for Home Health Agencies (HHAs) (§ 484.22)

M. Emergency Preparedness Regulations for Comprehensive Outpatient Rehabilitation Facilities (CORFs) (§ 485.68)

N. Emergency Preparedness Regulations for Critical Access Hospitals (CAHs) (§ 485.625)

O. Emergency Preparedness Regulations for Clinics, Rehabilitation Agencies, and Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services (Organizations) (§ 485.727)

P. Emergency Preparedness Regulations for Community Mental Health Centers (CMHCs) (§ 485.920)

Q. Emergency Preparedness Regulations for Organ Procurement Organizations (OPOs) (§ 486.360)

R. Emergency Preparedness Regulations for Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) (§ 491.12)

S. Emergency Preparedness Regulations for End-Stage Renal Disease (ESRD) Facilities (§ 494.62)

III. Provisions of the Final Regulations

A. Changes Included in the Final Rule

B. Incorporation by Reference

IV. Collection of Information

V. Regulatory Impact Analysis

VI. Waiver of Proposed Rulemaking

I. Overview

A. Executive Summary

1. Purpose

We have reviewed existing Medicare emergency regulatory preparedness requirements for both providers and suppliers. We found that many providers and suppliers have emergency preparedness requirements, but those requirements do not go far enough in ensuring that these providers and suppliers are equipped and prepared to help protect those they serve during emergencies and disasters. Hospitals, for example, are currently required to have emergency power and lighting in some specified areas and there must be facilities for emergency gas and water supply. We believe that these existing requirements are generally insufficient in the face of the needs of the patients, staff and communities, and do not address inconsistency in the level of emergency preparedness amongst healthcare providers. For example, while some accreditation organizations have standards that exceed CMS' current requirements for hospitals by requiring them to conduct a risk assessment, there are other providers and suppliers who do not have any emergency preparedness requirements, such as Community Mental Health Centers (CMHCs) and Psychiatric Residential Treatment Facilities (PRTFs). We concluded that current emergency preparedness requirements are not comprehensive enough to address the complexities of the actual emergencies. Over the past several years, the United States has been challenged by several natural and man-made disasters. As a result of the September 11, 2001 terrorist attacks, the subsequent anthrax attacks, the catastrophic hurricanes in the Gulf Coast states in 2005, flooding in the Midwestern states in 2008, the 2009 H1N1 influenza pandemic, tornadoes and floods in the spring of 2011, and Hurricane Sandy in 2012, our nation's health security and readiness for public health emergencies have been on the national agenda. This final rule issues emergency preparedness requirements that establish a comprehensive, consistent, flexible, and dynamic regulatory approach to emergency preparedness and response that incorporates the lessons learned from the past, combined with the proven best practices of the present. We recognize that central to this approach is to develop and guide emergency preparedness and response within the framework of our national healthcare system. To this end, these requirements also encourage providers and suppliers to coordinate their preparedness efforts within their own communities and states as well as across state lines, as necessary, to achieve their goals.

2. Summary of the Major Provisions

We are issuing emergency preparedness requirements that will be consistent and enforceable for all affected Medicare and Medicaid providers and suppliers (referred to collectively as “facilities,” throughout the remainder of this final rule where applicable). This final rule addresses the three key essentials we believe are necessary for maintaining access to healthcare services during emergencies: safeguarding human resources, maintaining business continuity, and protecting physical resources. Current regulations for Medicare and Medicaid providers and suppliers do not adequately address these key elements.

Based on our research and consultation with stakeholders, we have identified four core elements that are central to an effective and comprehensive framework of emergency preparedness requirements for the various Medicare- and Medicaid-participating providers and suppliers. The four elements of the emergency preparedness program are as follows:

• Risk assessment and emergency planning: We are requiring facilities to perform a risk assessment that uses an “all-hazards” approach prior to establishing an emergency plan. The all-hazards risk assessment will be used to identify the essential components to be integrated into the facility emergency plan. An all-hazards approach is an integrated approach to emergency preparedness planning that focuses on capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters. This approach is specific to the location of the provider or supplier and considers the particular types of hazards most likely to occur in their areas. These may include, but are not limited to, care-related emergencies; equipment and power failures; interruptions in communications, including cyber-attacks; loss of a portion or all of a facility; and, interruptions in the normal supply of essentials, such as water and food. Additional information on the emergency preparedness cycle can be found at the Federal Emergency Management Agency (FEMA) National Preparedness System Web site located at: https://www.fema.gov/threat-and-hazard-identification-and-risk-assessment .
• Policies and procedures: We are requiring that facilities develop and implement policies and procedures that support the successful execution of the emergency plan and risks identified during the risk assessment process.
• Communication plan: We are requiring facilities to develop and maintain an emergency preparedness communication plan that complies with both federal and state law. Patient care must be well-coordinated within the facility, across healthcare providers, and with state and local public health departments and emergency management agencies and systems to protect patient health and safety in the event of a disaster. The following link is to FEMA's comprehensive preparedness guide to develop and maintain emergency operations plans: https://www.fema.gov/media-library-data/20130726-1828-25045-0014/cpg_101_comprehensive_preparedness_guide_developing_and_maintaining_emergency_operations_plans_2010.pdf . During an emergency, it is critical that hospitals, and all providers/suppliers, have a system to contact appropriate staff, patients' treating physicians, and other necessary persons in a timely manner to ensure continuation of patient care functions throughout the facilities and to ensure that these functions are carried out in a safe and effective manner.
• Training and testing: We are requiring that a facility develop and maintain an emergency preparedness training and testing program. A well-organized, effective training program must include initial training for new and existing staff in emergency preparedness policies and procedures as well as annual refresher trainings. The facility must offer annual emergency preparedness training so that staff can demonstrate knowledge of emergency procedures. The facility must also conduct drills and exercises to test the emergency plan to identify gaps and areas for improvement. The Homeland Security Exercise and Evaluation Program (HSEEP), developed by FEMA, includes a section on the establishment of a Training and Exercise Planning Workshop (TEPW). The TEPW section provides guidance to organizations in conducting an annual TEPW and developing a Multi-year Training and Exercise Plan (TEP) in line with the (HSEEP): http://www.fema.gov/media-library-data/20130726-1914-25045-8890/hseep_apr13_.pdf .

B. Current State of Emergency Preparedness

As previously discussed, numerous natural and man-made disasters have challenged the United States over the past several years. Disasters can disrupt the environment of healthcare and change the demand for healthcare services; therefore, it is essential that healthcare facilities integrate emergency management into their daily functions and values. On December 27, 2013, we published a proposed rule titled, “Medicare and Medicaid Programs; Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers” (78 FR 79082). In this proposed rule we included a robust discussion about the current state of emergency preparedness and federal emergency preparedness activities that have established a foundation for the development and expansion of healthcare emergency preparedness systems. In addition, the December 2013 proposed rule included an appendix of the numerous resources and documents used to develop the proposed rule. We refer readers to the proposed rule for this background information.

The December 2013 proposed rule included discussion of previous events, such as the 2009 H1N1 influenza pandemic, the 2001 anthrax attacks, the tornados in 2011 and 2012, and Hurricane Sandy in 2012. In 2014, the United States faced a number of new and emerging diseases, such as MERS-CoV and Ebola, and a nationwide outbreak of Enterovirus D68, which was confirmed in 938 people in 46 states between mid-August and October 21, 2014 ( http://www.cdc.gov/non-polio-enterovirus/outbreaks/EV-D68-outbreaks.html ). We believe that finalizing the emergency preparedness rule is an important part of improving the national response to Ebola and any infectious disease threats. Healthcare providers have raised concerns about their safety when caring for patients with Ebola, citing the need for advanced preparation, effective policies and procedures, communication plans, and sufficient training and testing, particularly for personal protection equipment (PPE). The response highlighted the importance of establishing written procedures, protocols, and policies ahead of an emergency event. With the finalization of the emergency preparedness rule, this type of planning will be mandated for Medicare and Medicaid participating hospitals and other providers and suppliers through the conditions of participation (CoPs) and conditions for coverage (CfCs) established by this rule.

C. Statutory and Regulatory Background

Various sections of the Social Security Act (the Act) define the types of providers and suppliers that may participate in Medicare and Medicaid and list the requirements that each provider and supplier must meet to be eligible for Medicare and Medicaid participation. The Act also authorizes the Secretary to establish other requirements as necessary to protect the health and safety of patients, although the wording of such authority differs slightly between provider and supplier types. Such requirements may include the CoPs for providers, CfCs for suppliers, and requirements for long-term care facilities. The CoPs and CfCs are intended to protect public health and safety and promote high quality care for all persons. Furthermore, the Public Health Service (PHS) Act sets forth additional regulatory requirements that certain Medicare providers and suppliers are required to meet in order to participate.

The following are the statutory and regulatory citations for the providers and suppliers for which we are issuing emergency preparedness regulations:

• Religious Nonmedical Health Care Institutions (RNHCIs)—section 1821 of the Act and 42 CFR 403.700 through 403.756.
• Ambulatory Surgical Centers (ASCs)—section 1832(a)(2)(F)(i) of the Act and 42 CFR 416.2 and 416.40 through 416.52.
• Hospices—section 1861(dd)(1) of the Act and 42 CFR 418.52 through 418.116.
• Inpatient Psychiatric Services for Individuals Under Age 21 in Psychiatric Residential Treatment Facilities (PRTFs)—sections1905(a) and 1905(h) of the Act and 42 CFR 441.150 through 441.182 and 42 CFR 483.350 through 483.376.
• Programs of All-Inclusive Care for the Elderly (PACE)—sections 1894, 1905(a), and 1934 of the Act and 42 CFR 460.2 through 460.210.
• Hospitals—section 1861(e)(9) of the Act and 42 CFR 482.1 through 482.66.
• Transplant Centers—sections 1861(e)(9) and 1881(b)(1) of the Act and 42 CFR 482.68 through 482.104.
• Long Term Care (LTC) Facilities—Skilled Nursing Facilities (SNFs)—under section 1819 of the Act, Nursing Facilities (NFs)—under section 1919 of the Act, and 42 CFR 483.1 through 483.180.
• Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID)—section 1905(d) of the Act and 42 CFR 483.400 through 483.480.
• Home Health Agencies (HHAs)—sections 1861(o), 1891 of the Act and 42 CFR 484.1 through 484.55.
• Comprehensive Outpatient Rehabilitation Facilities (CORFs)—section 1861(cc)(2) of the Act and 42 CFR 485.50 through 485.74.
• Critical Access Hospitals (CAHs)—sections 1820 and 1861(mm) of the Act and 42 CFR 485.601 through 485.647.
• Clinics, Rehabilitation Agencies, and Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services—section 1861(p) of the Act and 42 CFR 485.701 through 485.729.
• Community Mental Health Centers (CMHCs)—section 1861(ff)(3)(B)(i)(ii) of the Act, section 1913(c)(1) of the PHS Act, and 42 CFR 410.110.
• Organ Procurement Organizations (OPOs)—section 1138 of the Act and section 371 of the PHS Act and 42 CFR 486.301 through 486.348.
• Rural Health Clinics (RHCs)—section 1861(aa) of the Act and 42 CFR 491.1 through 491.11; Federally Qualified Health Centers (FQHCs)—section 1861(aa) of the Act and 42 CFR 491.1 through 491.11, except 491.3.
• End-Stage Renal Disease (ESRD) Facilities—sections 1881(b), 1881(c), 1881(f)(7) of the Act and 42 CFR 494.1 through 494.180.

The proposed rule responded to concerns from the Congress, the healthcare community, and the public regarding the ability of healthcare facilities to plan and execute appropriate emergency response procedures for disasters. In the proposed rule, we identified four core elements that we believe are central to an effective emergency preparedness system and must be addressed to offer a more comprehensive framework of emergency preparedness requirements for the various Medicare- and Medicaid-participating providers and suppliers. The four elements are—(1) risk assessment and emergency planning; (2) policies and procedures; (3) communication plan; and (4) training and testing. We proposed that these core components be used across provider and supplier types as diverse as hospitals, organ procurement organizations, and home health agencies, while attempting to tailor requirements for individual provider and supplier types to meet their specific needs and circumstances, as well as the needs of their patients, residents, clients, and participants. These proposals are refined and adopted in this final rule.

II. Provisions of the Proposed Rule and Responses to Public Comments

In response to our December 2013 proposed rule, we received nearly 400 public comments. Commenters included individuals, healthcare professionals and corporations, national associations, health departments and emergency management professionals, and individual facilities that would be impacted by the regulation. Most comments centered around the hospital requirements, but could be applied to the additional provider and supplier types. We also received comments specific to the requirements we proposed for other individual provider and supplier types. In addition, we solicited comments on specific issues. We have organized our responses to the comments as follows: (1) General comments; (2) implementation date; (3) comments specific to hospitals and those that apply to the overall requirements of the regulation; and (4) comments specific to other providers and suppliers.

A. General Comments

We received the following comments suggesting improvement to our regulatory approach or requesting clarification of the resources used to develop our proposals:

Comment: Most commenters supported our proposal to require Medicare and Medicaid participating facilities to establish an emergency preparedness plan. Many of these commenters noted that this proposal is timely and necessary in light of past emergencies and natural disasters.

Response: We thank the commenters for their support. We continue to believe that our current regulations for Medicare and Medicaid providers and suppliers do not adequately address emergency preparedness planning and that emergency preparedness CoPs for providers and CfCs for suppliers should be implemented at this time.

Comment: Several commenters disagreed with our proposal to establish emergency preparedness requirements for Medicare and Medicaid providers and suppliers. Some commenters were concerned that this proposal would place undue burden and financial strain on facilities. Most of these commenters stated that it would be difficult to implement additional regulations without additional payment through Medicare, Medicaid, or the Hospital Preparedness Program (HPP). The commenters also stated that facilities would need more time to comply with the proposed requirements.

A few commenters disagreed with our statement that hospitals should have emergency preparedness plans and stated that hospitals are already prepared for emergencies. A commenter objected to the statement that hospital leadership has not prioritized disaster preparedness.

A commenter recommended that the proposed emergency preparedness requirements be reduced and simplified to reflect the minimum requirements that each provider type is expected to meet. Other commenters objected to the entire proposal and the establishment of additional regulations for healthcare facilities.

Response: We disagree with the commenters who stated that the emergency preparedness regulations are inappropriate or unnecessary. Healthcare facilities in the United States have faced many challenges over the years including hurricanes, tornados, floods, wild fires, and pandemics. Facilities that do not have plans established prior to an emergency or a disaster may face difficulties providing continuity of care for their patients. In addition, without proper training, healthcare workers may find it difficult to implement emergency preparedness plans during an emergency or a disaster.

Upon review of the current emergency preparedness requirements for providers and suppliers participating in Medicare and Medicaid, we concluded that the current requirements are not comprehensive enough to address the complexities of actual emergencies. We believe that, currently, in the event of a disaster, healthcare facilities across the nation will not have the necessary emergency planning and preparation in place to adequately protect the health and safety of their patients. In addition, we believe that the current regulatory patchwork of federal, state, and local laws and guidelines, combined with various accrediting organizations' emergency preparedness standards, falls far short of what is needed for healthcare facilities to be adequately prepared for a disaster. Therefore, we proposed to establish comprehensive, consistent, and flexible emergency preparedness regulations that incorporate lessons learned from the past with the proven best practices of the present. Finalizing these proposals, with the modifications discussed later in this final rule, will help healthcare facilities be better prepared in case of a disaster or emergency. We note that the majority of the comments to the proposed rule agree with the establishment of some type of regulatory framework for emergency preparedness planning, which further supports our position that establishing emergency preparedness regulations is the most appropriate course of action.

In response to comments that request additional time for compliance or additional funds, we refer readers to the discussion on the implementation date and further discussions on funding in this final rule.

Comment: Some commenters stated that the term “ensure” was used numerous times in the proposed rule and that the term was over-used. Commenters stated that in some circumstances we stated providers and suppliers had to “ensure” elements of the plan that might be beyond their control during an emergency. A commenter suggested that we replace the word “ensure” with the term “strive to achieve.”

Response: We used the word “ensure” or “ensuring” to convey that each provider and supplier will be held accountable for complying with the requirements in this rule. However, to avoid any ambiguity, we have removed the term “ensure” and “ensuring” from the regulation text of all providers and suppliers and have addressed the requirements in a more direct manner.

Comment: Some commenters were concerned that the proposed emergency preparedness requirements duplicate existing requirements by The Joint Commission (TJC). TJC is a CMS-approved accrediting organization that has standards and survey procedures that meet or exceed those used by CMS and state surveyors. Facilities accredited under a Medicare approved accreditation program, such as TJC's, may be “deemed” by CMS to be in compliance with the CoPs. Most of these commenters recommended that CMS rely on existing TJC standards. Other commenters noted that CMS used TJC manual citations from 2007 through 2008. The commenters noted that changes have been made since then and recommended that CMS refer to the most recent TJC manual.

Response: We discussed TJC standards in the proposed rule as a point of reference for emergency preparedness standards that currently exist for healthcare facilities, absent additional federal regulations. We note that CMS has the authority to create and modify CoPs, which establish the requirements a provider must meet to participate in the Medicare or Medicaid program. Also, we note that facilities that exceed CMS's requirements will still remain compliant.

Comment: A few commenters stated that the proposal did not take into account the differences that exist between individual facilities. The commenters noted that the proposal does not acknowledge the diversity of different facilities and instead requires a “one size fits all” emergency preparedness plan. The commenters recommended that CMS address the variation between facilities in the emergency preparedness requirements.

Some commenters stated that the proposed requirements are inappropriate because they mostly apply to hospitals, and cannot be applied to other healthcare settings. A commenter noted that smaller hospitals with limited capabilities, like LTCHs, should be allowed to work with their local emergency response networks to develop emergency preparedness plans that reflect those hospitals' limitations.

Response: We believe our approach, with the changes to our proposal discussed later in this final rule, appropriately addresses the differences between the 17 provider and supplier types covered by these regulations. We believe that emergency preparedness regulations that are too specific may become outdated over time, as technology and the nature of threats change, and that emergency preparedness regulations that are too broad may be ineffective. Therefore, we proposed four main components that are consistent with the principles as set forth in the National Preparedness Cycle contained within the National Preparedness System (link (see: https://www.fema.gov/national-preparedness-system ) that can be used across diverse healthcare settings, while tailoring specific requirements for individual provider and supplier types based on their needs and circumstances, as well as the needs and circumstances of their patients, residents, clients, and participants. We continue to believe that these four components, and the variations in the specific requirements of these components, appropriately address variation amongst provider and supplier settings and facilities with an appropriate amount of flexibility. We do not believe that we have taken a “one size fits all” approach in these regulations.

We agree with the commenter who stated that smaller hospitals should be allowed to work with their local health department and emergency management agency to develop emergency preparedness plans and we encourage these facilities to engage in healthcare coalitions in their area for assistance in meeting these requirements. However, we note that we are not mandating that smaller facilities confer with local emergency response networks while developing their emergency preparedness plans.

Comment: A few commenters stated that the proposed provisions were too specific and detailed. Some commenters believed that, like other CoPs, the proposal should include provisions that are more flexible. The commenters noted that more specificity should be included in CMS' interpretive guidance documents (IGs).

Response: We disagree with commenters. We believe that these regulations strike a balance between the specific and the general. We have not prescribed or mandated specific technology or tools, nor have we included detailed requirements for how emergency preparedness plans should be written. The regulations are broad enough that facilities can formulate an effective emergency preparedness plan, based on a facility-based and community-based risk assessment utilizing an all-hazards approach, that includes appropriate policies and procedures, a communication plan, and training and testing. In meeting the emergency preparedness requirements, providers can tailor specific details to their facilities' and their patients' needs. Facilities can also exceed the requirements in this final rule, if they believe it is in their patients' and their facilities' interests to do so.

Comment: A few commenters suggested that CMS require facilities to include other entities, stakeholders, and individuals in their emergency preparedness planning. Specifically, a few commenters suggested that facilities include patients, their family members, and vulnerable populations, including older adults, people with disabilities, and those who are linguistically isolated, in their emergency preparedness planning. A few commenters also recommended that facilities include patients and their families in emergency preparedness education. A few commenters recommended that front line workers and their workers' unions be included in the emergency preparedness planning. A commenter suggested that CMS emphasize the full continuum of emergency management activities and identify relevant national associations and resources for each provider type.

A commenter noted that local emergency management officials are rarely included in emergency planning. The commenter recommended adding a requirement that would require facilities to submit their emergency preparedness plan to their local emergency management agency for review and assessment, and for assistance on sheltering and evacuation procedures.

Response: In the proposed rule, we proposed to require certain facilities to develop a method for sharing information from the emergency plan that the facility determines is appropriate with patients/residents and their families or representatives. A facility may choose to involve other entities in the development of an emergency preparedness plan or they can provide emergency preparedness education to patients' families and caregivers. During the development of the emergency plan, facilities may also choose to include patients, community members and others in the process. However, we are not mandating these actions as we believe such a requirement would impose an excessive burden on providers and suppliers; instead, we encourage and will allow facilities the discretion to confer with entities and resources that they consider appropriate while creating an emergency preparedness plan and strongly encourage that facilities include individuals with disabilities and others with access and functional needs in their planning.

Comment: A commenter recommended that emergency preparedness plans should account for children's special needs during an emergency. The commenter stated that emergency preparedness plans should include children's medication and medical device needs, challenges regarding patient transfer for neonatal and pediatric intensive care patients, and issues involving behavioral health and family reunification.

A commenter recommended that CMS collaborate closely with the Emergency Medical Services for Children (EMSC) program administered by the Health Resources and Services Administration (HRSA). The commenter noted that this program focuses on improving the pediatric components of the EMS system.

Response: We appreciate the commenter's concerns. As required in § 482.15(a)(1), (2), and (3), when a provider or supplier develops an emergency preparedness plan, we will expect that the provider/supplier will use a facility-based and community-based risk assessment to develop a plan that addresses that facility's patient population, including at-risk populations. If the provider serves children, or if the majority of its patient population is children, as is the case for children's hospitals, we will expect the provider to take into account children's access and functional needs during an emergency or disaster in its emergency preparedness plan.

Comment: A few commenters questioned CMS' definition of an emergency. A commenter disagreed with the proposed rule's definition of “emergency” and “disaster.” The commenter stated that the proposed rule definitions exclude internal or smaller disasters that a hospital may declare. Furthermore, the commenter noted that the definitions should include mass casualty incidents and internal emergencies or disasters that a facility may declare. Another commenter requested clarification as to whether the regulation applies to external or internal emergencies.

Response: In the proposed rule, we defined an “emergency” or “disaster” as an event affecting the overall target population or the community at large that precipitates the declaration of a state of emergency at a local, state, regional, or national level by an authorized public official such as a Governor, the Secretary of the Department of Health and Human Services (HHS), or the President of the United States. However, we agree with the commenter's observation that the definition of an “emergency” or “disaster” should include internal emergency or disaster events. Therefore, we clarify our statement that an “emergency” or “disaster” is an event that can affect the facility internally as well as the overall target population or the community at large.

We believe that hospitals should have a single emergency plan that addresses all-hazards, including internal emergencies and a man-made emergency (or both) or natural disaster. Hospitals have the discretion to determine when to activate their emergency plan and whether to apply their emergency plan to internal or smaller emergencies or disasters that may occur within their facilities. We encourage hospitals to prepare for all-hazards that may affect their patient population and apply their emergency preparedness plans to any emergency or disaster that may arise. Furthermore, we encourage hospitals that may be dealing with an internal emergency or disaster to maintain communication with external emergency preparedness entities and other facilities where appropriate.

Comment: A few commenters were concerned that the proposed rule did not require planning for recovery of operations. The commenters recommended that CMS include requirements for facilities to plan for the return of normal operations after an emergency. A commenter recommended that CMS include requirements for provider preparedness in case of an information technology (IT) system failure.

Response: We understand the commenter's concerns and believe that facilities should consider planning for recovery of operations during the emergency or disaster response. Recovery of operations will require that facilities coordinate efforts with the relevant health department and emergency management agencies to restore facilities to their previous state prior to the emergency or disaster event. Our new emergency preparedness requirements focus on continuity of operations, not recovery of operations. Facilities can choose to include recovery of operations planning in their emergency preparedness plan, but we have not made recovery of operations planning a requirement.

We refer commenters that are interested in recovery of operations planning to the following resources for more information:

• National Disaster Recovery Framework (NDRF): https://www.fema.gov/national-disaster-recovery-framework.
• Continuity Guidance Circular 1 (CGC 1), and Continuity Guidance for Non-Federal Entities (States, Territories, Tribal, and Local Government Jurisdictions and Private Sector Organizations) http://www.fema.gov/pdf/about/org/ncp/cont_guidance1.pdf.
• National Preparedness System ( https://www.fema.gov/national-preparedness-system )
• Comprehensive Preparedness Guide 101 http://www.fema.gov/media-library-data/20130726-1828-25045-0014/cpg_101_comprehensive_preparedness_guide_developing_and_maintaining_emergency_operations_plans_2010.pdf )

Comment: A commenter requested clarification on whether hospitals would have direct access to the Emergency System for Advance Registration of Volunteer Health Professionals (ESAR-VHP).

A commenter recommended that CMS work with other federal agencies, including the Department of Homeland Security (DHS) and the Federal Emergency Management Agency (FEMA) to expand ESAR-VHP and Medical Reserve Corps (MRC) team deployments to a 3 month rotation basis. The commenter also recommended that CMS purchase and pre-position Federal Reserve Inventories (FRI) at healthcare distributorships.

Response: Hospitals do not have direct access to the Emergency System for Advance Registration of Volunteer Health Professional (ESAR-VHP). The Assistant Secretary for Preparedness and Response (ASPR) manages the ESAR-VHP program. The program is administered on the state level. A hospital would request volunteer health professionals through State Emergency Management. For more information, reviewers may email ASPR at esarvhp@hhs.gov or visit the ESAR/VHP Web site: http://www.phe.gov/esarvhp/pages/home.aspx . Volunteer deployments typically last for 2 weeks and are not extended without the agreement of the volunteer.

In regards to the comment on the Federal Reserve Inventories, we believe that the commenter may be referring to the Strategic National Stockpile (SNS). The SNS program is a national repository of antibiotics, chemical antidotes, antitoxins, life-support medications, and medical supplies. It is not within CMS' purview to purchase, administer, or maintain SNS stock. We refer commenters who have questions about the SNS program to the Centers for Disease Control and Prevention (CDC) Web site at http://emergency.cdc.gov/stockpile/index.asp .

Comment: A commenter noted that CMS did not include emergency preparedness requirements for transport units (fire and rescue units, and ambulances). Furthermore, the commenter questioned whether a Certificate of Need (CON) is necessary during an emergency.

Another commenter questioned why large single specialty and multispecialty medical groups are not discussed as included or excluded in this rule. The commenter noted that these entities have Medicare and Medicaid provider status; therefore, should be included in this rule. Another commenter questioned whether the proposed regulations would apply to residential drug and alcohol treatment centers. The commenter noted that if this is the case, it would be difficult for these centers to meet the proposed requirements due to lack of funding.

Response: The emergency preparedness requirements only pertain to the 17 provider and supplier types discussed previously in this rule, which have existing CoPs or CfCs. These provider and supplier types do not include fire and rescue units, and ambulances, or single-specialty/multi-specialty medical groups. Entities that work with hospitals or any of the other provider and supplier types covered by this regulation may have a role in the provider's or supplier's emergency preparedness plan, and providers or suppliers may choose to consider the role of these entities in their emergency preparedness plan. In addition, we note that CMS does not exercise regulatory authority over drug and alcohol treatment centers.

In response to the question about a Certificate of Need, we note that facilities must formulate an emergency preparedness plan that complies with state and local laws. A Certificate of Need is a document that is needed in some states and local jurisdiction before the creation, acquisition, or expansion of a facility is allowed. Facilities should check with their state and local authorities in regards to Certificate of Need requirements.

Comment: A commenter requested clarification on a facility's responsibility to patients that have already evacuated the facility on their own.

Response: Facilities are required to track the location of staff and patients in the facility's care during an emergency. The facility is not required to track the location of patients who have voluntarily left on their own, since they are no longer in the facility's care. However, if a patient voluntarily leaves a facility's care during an emergency or a disaster, the facility may choose to inform the appropriate health department and emergency management or emergency medical services authorities if it believes the patient may be in danger.

Comment: A commenter questioned whether the requirements take into account the role of the physician during emergency preparedness planning. The commenter questioned whether physicians will be required to provide feedback during the planning process, whether physicians would have a role in preserving patient medical documentation, whether physicians would be involved in determining arrangements for patients during a cessation of operations, and to what extent physicians would be required to participate in training and testing.

Response: Individual physicians are not required, but are encouraged, to develop and maintain emergency preparedness plans. However, physicians that work in a facility that is required to develop and maintain an emergency preparedness plan can and are encouraged to provide feedback or suggestions for best practices. In addition, physicians that are employed by the facility and all new and existing staff must participate in emergency preparedness training and testing. We have not mandated a specific role for physicians during an emergency or disaster event, but we expect facilities to delineate responsibilities for all of their facility's workers in their emergency preparedness plans and to determine the appropriate level of training for each professional role.

Comment: A commenter objected to use of the term “volunteers” in the proposed rule. The commenter stated that this term was not defined and recommended that the proposal be limited to healthcare professionals used to address surge needs during an emergency. Another commenter recommended that the regulation text should be revised to include the language, “Use of health care volunteers”, to further clarify this distinction.

Response: We provided information on the use of volunteers in the proposed rule (78 FR 79097), specifically with reference to the Medical Reserve Corps and the ESAR-VHP programs. Private citizens or medical professionals not employed by a hospital or facility often offer their voluntary services to hospitals or other entities during an emergency or disaster event. Therefore, we believe that facilities should have policies and procedures in place to address the use of volunteers in an emergency, among other emergency staffing strategies. We believe such policies should address, among other things, the process and role for integration of healthcare professionals that are locally-designated, such as the Medical Reserve Corps ( https://www.medicalreservecorps.gov/HomePage ), or state-designated, such as Emergency System for Advance Registration of Volunteer Health Professional (ESAR-VHP), ( http://www.phe.gov/esarvhp/pages/home.aspx ) that have assisted in addressing surge needs during prior emergencies. As with previous emergencies, facilities may choose to utilize assistance from the MRC or through the state ESAR-VHP program. We believe the description of healthcare volunteers is already included in the current requirement and does not need to be further defined.

Comment: A commenter questioned if the proposal will require facilities to plan for an electromagnetic event. The commenter noted that protecting against and treating patients after an electromagnetic event is costly.

Another commenter recommended that the rule explicitly include and address the threats of fire, wildfires, tornados, and flooding. The commenter notes that these scenarios are not included in the National Planning Scenarios (NPS).

Response: We expect facilities to develop an emergency preparedness plan that is based on a facility-based and community-based risk assessment using an “all-hazards” approach. If a provider or supplier determines that its facility or community is at risk for an electromagnetic event or natural disasters, such as fires, wildfires, tornados, and flooding, the provider or supplier can choose to incorporate planning for such an event into its emergency preparedness plan. We note that compliance with these requirements, including a determination of whether the provider or supplier based its emergency preparedness plan on facility-based and community-based risk assessments using an all-hazards approach, will be assessed through on-site surveys by CMS, State Survey Agencies, or Accreditation Organizations with CMS-approved accreditation programs.

Comment: A few commenters had recommendations for the structure and organization of the proposed rule. A commenter recommended that CMS specify the 17 providers and supplier types to which the rule would apply in the first part of the rule, so that facilities could verify whether or not the regulations would apply to them. A few commenters suggested that the requirements of the proposed rule should not be included in the CoPs, but instead comprise a separate regulatory chapter specific to emergency preparedness.

Response: We included a list of the provider and supplier types affected by the emergency preparedness requirements in the proposed rule's Table of Contents (78 FR 79083 through 79084) and in the preamble text 78 FR 79090. Thus, we believe that we clearly listed the affected providers and suppliers at the very beginning of the proposed rule.

We also believe the emergency preparedness requirements should be included in the CoPs for providers, the CfCs for suppliers, and requirements for LTC facilities. These CoPs, CfCs, and requirements for LTC facilities are intended to protect public health and safety and ensure that high quality care is provided to all persons. Facilities must meet their respective CoPs, CfCs, or requirements in order to participate in the Medicare and Medicaid programs. We are able to enforce and monitor compliance with the CoPs, CfCs, and requirements for LTC facilities through the survey process. Therefore, we believe that the emergency preparedness requirements are included in the most appropriate regulatory chapters.

Comment: A few commenters suggested additional citations for the proposed rule, recommended that we include specific reference material, and suggested edits to the preamble language. A commenter stated that we omitted some references in the preamble discussion of the proposed rule. The commenter noted that while we included references to HSPD 5, 21, and 8 in the proposed rule, the commenter recommended that all of the HSPDs should have been included. Furthermore, the commenter noted that HSPD 7 in particular, which does not provide a specific role for HHS, should have been referenced since it includes discussion of critical infrastructure protection and the role it plays in all-hazards mitigation.

A commenter suggested that we add the following text to section II.B.1.a. of the proposed rule (78 FR 79085): “HSPD-21 tasked the establishment of the National Center for Disaster Medicine and Public Health ( http://ncdmph.usuhs.edu ) as an academic center of excellence at the Uniformed Services University of the Health Sciences to lead federal efforts in developing and propagating core curricula, training, and research in disaster health.”

A commenter recommended that we include the Joint Guidelines for Care of Children in the Emergency Department, developed by the American Academy of Pediatrics, the American College of Emergency Physicians, and the Emergency Nurses Association, as a resource for the final rule.

A commenter suggested the addition of the phrase “private critical infrastructure” to the following statement on page 79086 of the proposed rule: “The Stafford Act authorizes the President to provide financial and other assistance to state and local governments, certain private nonprofit organizations, and individuals to support response, recovery, and mitigation efforts.”

A commenter included several articles and referenced documentation on emergency preparedness and proper management and disposal of medical waste materials, while another recommended that CMS reference specific FEMA reference documents. Another commenter referred CMS to the Comprehensive Preparedness Guidelines 101 Template, although the commenter did not specify the source of this template.

Response: We thank the commenters for their recommended edits throughout the document. The editorial suggestions are appreciated and noted. We also want to thank commenters for their recommendations for additional resources on emergency preparedness. We provided an extensive list of resources in the proposed and have included links to various resources in this final rule that facilities can use as resources during the development of their emergency preparedness plans. However, we note that these lists are not comprehensive, since we intend to allow facilities flexibility as they implement the emergency preparedness requirements. We encourage facilities to use any resources that they find helpful as they implement the emergency preparedness requirements. Omissions from the list of resources set out in the proposed rule do not indicate any intention on our part to exclude other resources from use by facilities.

Comment: A commenter stated that the local emergency management and public health authorities are the best-placed entities to coordinate their communities' disaster preparedness and response, collaborating with hospitals as instrumental partners in this effort.

Response: We stated in the proposed rule that local emergency management and public health authorities play a very important role in coordinating their community's disaster preparedness and response activities. We proposed that each hospital develop an emergency plan that includes a process for ensuring cooperation and collaboration with local, tribal, regional, state and federal emergency preparedness officials' efforts to ensure an integrated response during a disaster or emergency situation. We also proposed that hospitals participate in community mock disaster drills. As noted in the proposed rule, we believe that community-wide coordination during a disaster is vital to a community's ability to maintain continuity of healthcare for the patient population during and after a disaster or emergency.

Comment: A few commenters were concerned about the exclusion of specific requirements to account for the health and safety of healthcare workers. A commenter, in reference to pediatric healthcare, recommended that we consider adding a behavioral healthcare provision to the emergency preparedness requirements, which would account for the professional self-care needs of healthcare providers. Another commenter suggested that we change the language on page 79092 of the proposed rule to include 5 phases of emergency management, with the addition of the phrase “protection of the safety and security of occupants in the facility.” Another commenter recommended that we include occupational health and safety elements in the four proposed emergency preparedness standards. Furthermore, the commenter recommended that we consult with the Occupational Safety and Health Administration (OSHA), the National Institute for Occupational Safety and Health (NIOSH), and the Worker Education and Training Program of the National Institute for Environmental Health Sciences (NIEHS) for more information on integrating worker health and safety protections into emergency planning.

Response: While we believe that providers should prioritize the health and safety of their healthcare workers during an emergency, we do not believe that it is appropriate to include detailed requirements within this regulation. As we have previously stated, the regulation is not intended to be overly prescriptive. Therefore, providers have the discretion to establish policies and procedures in their emergency preparedness plans that meet the minimum requirements in this regulation and that are tailored to the specific needs and circumstances of the facility. We note that providers should continue to comply with pertinent federal, state, or local laws regarding the protection of healthcare workers in the workplace.

While it is not within the scope of this rule to address OSHA, NIOSH, or NIEHS work place regulations, we encourage providers and suppliers to consider developing policies and procedures to protect healthcare workers during an emergency. We refer readers to the following list of resources to aid providers and suppliers in the formulation of such policies and procedures:

• https://www.osha.gov/SLTC/emergencypreparedness/
• http://www.cdc.gov/niosh/topics/emergency.html
• http://www.niehs.nih.gov/health/topics/population/occupational/index.cfm

Comment: A few commenters noted that while section 1135 of the Act waives certain Conditions of Participation (CoPs) during a public health emergency, there is no authority to waive the Conditions for Payment (CfPs). The commenters recommended that the Secretary thoroughly review the requirements under the CoPs and the CfPs and seek authority from Congress to waive additional requirements under the CfPs that are burdensome and that affect timely access to care during emergencies.

Response: While we appreciate the concerns of the commenters, these comments are outside the scope of this rule.

1. Integrated Health Systems

In the proposed rule, we proposed that for each separately certified healthcare facility to have an emergency preparedness program that includes an emergency plan, based on a risk assessment that utilizes an all hazards approach, policies and procedures, a communication plan, and a training program.

Comment: We received a few comments that suggested we allow integrated health systems to have one coordinated emergency preparedness program for the entire system.

Commenters explained that an integrated health system could be comprised of two nearby hospitals, a LTC facility, a HHA, and a hospice. The commenters stated that under our proposed regulation, each entity would need to develop an individual emergency preparedness program in order to be in compliance. Commenters proposed that we allow for the development of one universal emergency preparedness program that encompasses one community-based risk assessment, separate facility-based risk assessments, integrated policies and procedures that meet the requirements for each facility, and coordinated communication plans, training and testing. They noted that allowing for a coordinated emergency preparedness program would ultimately reduce the burden placed on the individual facilities and provide for a more coordinated response during an emergency.

Response: We appreciate the comments received on this issue. We agree that allowing integrated health systems to have a coordinated emergency preparedness program is in the best interest of the facilities and patients that comprise a health system. Therefore, we are revising the proposed requirements by adding a separate standard to the provisions applicable to each provider and supplier type. This separate standard will allow any separately certified healthcare facility that operates within a healthcare system to elect to be a part of the healthcare system's unified emergency preparedness program. If a healthcare system elects to have a unified emergency preparedness program, this integrated program must demonstrate that each separately certified facility within the system actively participated in the development of the program. In addition, each separately certified facility must be capable of demonstrating that they can effectively implement the emergency preparedness program and demonstrate compliance with its requirements at the facility level.

As always, each facility will be surveyed individually and will need to demonstrate compliance. Therefore, the unified program will also need to be developed and maintained in a manner that takes into account the unique circumstances, patient populations, and services offered for each facility within the system. For example, for a unified plan covering both a hospital and a LTC facility, the emergency plan must account for the residents in the LTC facility as well as those patients within a hospital, while taking into consideration the difference in services that are provided at a LTC facility and a hospital. In addition, the healthcare system will need to take into account the resources each facility within the system has and any state laws that the facility must adhere to. The unified emergency preparedness program must also include a documented community-based risk assessment and an individual facility-based risk assessment for each separately certified facility within the health system, both utilizing an all-hazards approach. The unified program must also include integrated policies and procedures that meet the emergency preparedness requirements specific to each provider type as set forth in their individual set of regulations. Lastly, the unified program must have a coordinated communication plan and training and testing program. We believe that this approach will allow a healthcare system to spread the cost associated with training and offer a financial advantage to each of the facilities within a system. In addition, we believe that, in some cases this approach will provide flexibility and could potentially result in a more coordinated response during an emergency that will enable a more successful outcome.

2. Requests for Technical Assistance and Funding

The December 2013 proposed rule included an appendix of the numerous resources and documents used to develop the proposed rule. Specifically, the appendix to the proposed rule included helpful reports, toolkits, and samples from multiple government agencies such as ASPR, the CDC, FEMA, HRSA, AHRQ, and the Institute of Medicine (See Appendix A, 78 FR 79198). In response to our proposed rule, we received numerous comments requesting that we provide facilities with increased funding and technical assistance to implement our proposed regulations.

Comment: A few commenters appreciated the resources that we provided in the proposed rule, but expressed concerns that, despite the resources referenced in the regulation, busy and resource-constrained facilities will not have a simple and organized way to access technical assistance and other valuable information in order to comply with the proposed requirements. Commenters indicated that despite the success of healthcare coalitions, they have not been established in every region.

Commenters suggested that formal technical assistance should be available to facilities to help them successfully implement their emergency preparedness requirements. A commenter recommended that ASPR should lead this effort given its expertise in emergency preparedness planning and its charge to lead the nation in preventing, preparing for, and responding to the adverse health effects of public health emergencies. Another commenter suggested that we consider hosting regional meetings for facilities to share information and resources and that we provide region specific resources on our Web site. Commenters encouraged CMS to promote collaborative planning among facilities and provide the support needed for facilities to leverage each other's resources. These commenters believe that networks of facilities will be in a better position than governmental resources to identify cost and time saving efficiencies, but need support from CMS to coordinate their efforts.

Response: We appreciate the feedback from commenters and understand how valuable guidance and resources will be to providers and suppliers in order to comply with this regulation. We do not anticipate providing formal technical assistance, such as CMS-led trainings, to providers and suppliers. Instead, as with all of our regulations, we will release interpretive guidance for this regulation that will aid facilities in implementing these regulations and provide information regarding best practices. We strongly encourage facilities to review the interpretative guidance from us, use the guidance to identify best practices, and then network with other facilities to develop strategic plans. Providers and suppliers impacted by this regulation should collaborate and leverage resources in developing emergency preparedness programs to identify cost and time saving efficiencies. We note that in this final rule we have revised the proposed requirements to allow integrated health systems to elect to have one unified emergency preparedness program (see Section II.A.1.Intergrated Health Systems for a detailed discussion of the requirement). We believe that collaborative planning will not only leverage the financial burden on facilities, but also result in a more coordinated response to an emergency event.

In addition, we note that in the proposed rule, we indicated numerous resources related to emergency preparedness, including helpful reports, toolkits, and samples from ASPR, the CDC, FEMA, HRSA, AHRQ, and the Institute of Medicine (See Appendix A, 78 FR 79198). Providers and suppliers should use these many resources as templates and the framework for getting their emergency preparedness programs started. We also refer readers to SAMHSA's Disaster Technical Assistance Center (DTAC) for more information on delivering an effective mental health and substance abuse (behavioral health) response to disasters at http://www.samhsa.gov/dtac/ .

Finally we note that ASPR, as a leader in healthcare system preparedness, developed and launched the Technical Resources, Assistance Center, and Information Exchange (TRACIE). TRACIE is designed to provide resources and technical assistance to healthcare system preparedness stakeholders in building a resilient healthcare system. There are numerous products and resources located within the TRACIE Web site that target specific provider types affected by this rule. While TRACIE does not focus specifically on the requirements implemented in this regulation, this is a valuable resource to aid a wide spectrum of partners with their health system emergency preparedness activities. We strongly encourage providers and suppliers to utilize TRACIE and leverage the information provided by ASPR.

Comment: Some commenters noted that their region is currently experiencing a reduction in the federal funding they receive through the HPP. These commenters stated that the HPP program has proven to be successful and encouraged healthcare entities impacted by this regulation to engage their state HPP for technical assistance and training while developing their emergency preparedness programs. Commenters shared that HPP staff have established trusting and fundamental relationships with facilities, associations, and emergency managers throughout their state. Commenters expressed that while the program has been instrumental in supporting their state's healthcare emergency response, it does not make sense to impose these new emergency preparedness regulations while financial resources through the HPP are diminishing. Commenters stressed that the HPP program alone cannot support the rollout of these new regulations and emphasized that a strong and well-funded HHP program is needed to contribute to the successful implementation of these new requirements. Commenters also suggested that CMS offer training to the states' HPP programs, so that these agencies can remain in a central leadership role within their states.

Response: We appreciate the feedback and agree that the HPP program has been a fundamental resource for developing healthcare emergency preparedness programs. While we recognize that HPP funding is limited, we want to emphasize that the HPP program is not intended to solely fund a facility's individual emergency preparedness program and activities. Despite the limited financial resources, healthcare facilities should continue to engage their healthcare coalitions and state HPP coordinators for training and guidance. We encourage healthcare facilities, particularly those in neighboring geographic areas, to collaborate and build relationships that will allow facilities to share and leverage resources.

Comment: A few commenters noted that, while these new emergency preparedness regulations should be put in place to protect vulnerable communities, there should also be incentives to help facilities meet these new standards. Many commenters expressed concerns about the decrease in funding available to state and local governments. Most commenters recommended that grant funding and loan programs be provided to support hiring staff to develop or modify emergency plans. However, a few commenters suggested that federal funding should be allocated to the nation's most vulnerable counties. These commenters believe that special federal funding consideration should not be provided to all, but rather should be given to those counties and cities with a uniquely dense population. A commenter believed that incentives should be put in place to reward those facilities that are found compliant with the new standards. In addition, several commenters requested that CMS provide additional Medicare payment to providers and suppliers for implementing these emergency preparedness requirements.

Response: We currently expect facilities to have and develop policies and procedures for patient care and the overall operations. The emergency preparedness requirement may increase costs in the short term because resources will have to be devoted to the assessment and development of an emergency plan utilizing an all-hazards approach. While the requirements could result in some immediate costs to a provider or supplier, we believe that developing an emergency preparedness program will overall be beneficial to any provider or supplier. In addition, planning for the protection and care of patients, clients, residents, and staff during an emergency or a disaster is a good business practice. As we have previously noted, CMS has the authority to create and modify health and safety CoPs, which establish the requirements that a provider must meet in order to participate in the Medicare or Medicaid programs.

3. Requirement To Track Patients and Staff

In the proposed rule, we requested comments on the feasibility of tracking staff and patients in outpatient facilities.

Comment: Overall commenters agreed that there is not a crucial need for outpatient facilities to track their patients as compared to inpatient facilities. Commenters noted that outpatient providers and suppliers would most likely close their facilities prior to or immediately after an emergency, sending staff and patients home. We did not propose the tracking requirement for transplant centers, CORFs, Clinics, Rehabilitation Agencies, and Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services, and RHCs/FQHCs. For OPOs we proposed that they would only need to track staff. We stated that transplant centers' patients and OPOs' potential donors would be in hospitals, and thus, would be the hospital's responsibility.

Response: We agree with the majority of commenters and continue to believe that it is impractical for outpatient providers and suppliers to track patients and staff during and after an emergency. In the event of an emergency outpatient providers and suppliers will have the flexibility to cancel appointments and close their facilities. Therefore, we are finalizing the rule as proposed. Specifically, we do not require transplant centers, RHCs/FQHCs, CORFs, Clinics, Rehabilitation Agencies, and Public Health Agencies as providers of Outpatient Physical Therapy and Speech-Language Pathology Services to track their patients and staffs. We are also finalizing our proposal for OPOs to track staff only both during and after an emergency. A detailed discussion of comments specific to OPOs tracking staff can be found in section II.Q. of this final rule (Emergency Preparedness Regulations for Organ Procurement Organizations).

Comment: In addition to the feedback we received on whether we should require outpatient providers and suppliers to track their patients and staff, we also received varying comments in regards to the providers and suppliers that we did propose to meet the tracking requirement.Commenters supported the proposal for certain providers and suppliers to track staff and patients, and agreed that a system is needed. Some understood that the information about staff and patient location would be needed during an emergency, but stated that it would be burdensome and often unrealistic to expect providers and suppliers to locate individuals after an emergency event. Some commenters noted that patients at a receiving facility would be the responsibility of the receiving facility. Some commenters stated that tracking of patients going home is not their responsibility, or would be difficult to achieve. A commenter believed that tracking of staff would be a violation of staff's privacy. A commenter stated that in their large facility, only the “staff on duty” at the time of the emergency would be in their staffing system. Some commenters stated that staff would be difficult to track because some facilities have hundreds or thousands of employees, and some staff may have left to be with their families. Some commenters suggested that CMS promote the use of voluntary registries to help track their outpatient populations and encouraged coordination of these registries among facility types. A few commenters stated that one of the tools discussed in the preamble for tracking patients; namely, The Joint Patient Assessment and Tracking System (JPATS) was only available for hospitals and did not include other providers such as LTC facilities, and several stated the system is incompatible with their IT systems.

Response: For RNHCIs, PRTFs, PACE organizations, LTC facilities, ICFs/IID, hospitals, and CAHs, we proposed that these providers develop policies and procedures regarding a system to track the location of staff and patients in the hospital's care both during and after an emergency. Despite providing services on an outpatient basis, we also proposed to require hospices, HHAs, and ESRD facilities to assume this responsibility because these providers and suppliers would be required to provide continuing patient care during an emergency. We also proposed the tracking requirement for ASCs because we believed an ASC would maintain responsibility for their staff and patients if patients were in the facility.

After carefully analyzing the issues raised by commenters regarding the process to track staff and patients during and after an emergency, we agree with the commenters that our proposed requirements could be unnecessarily burdensome. We are revising the tracking requirements based on the type of facility. For CAHs, Hospitals, and RNHCIs we are removing the proposed requirement for tracking after an emergency. Instead, in this final rule we require that these facilities must document the specific name and location of the receiving facility or other location for patients who leave the facility during the emergency. We would expect facilities to track their on-duty staff and sheltered patients during an emergency and indicate where a patient is relocated to during an emergency (that is, to another facility, home, or alternate means of shelter, etc.).

Also, since providers and suppliers are required to conduct a risk assessment and develop strategies for addressing emergency events identified by the risk assessment, we would expect the facility to include in its emergency plan a method for contacting off-duty staff during an emergency and procedures to address other contingencies in the event staff are not able to report to duty which may include but are not limited to staff from other facilities and state or federally-designated health professionals.

For PRTFs, LTC facilities, ICF/IIDs, PACE organizations, CMHCs, and ESRD facilities we are finalizing as proposed the requirement to track staff and patients both during and after an emergency. We have clarified that the requirement applies to tracking on-duty staff and sheltered patients. Furthermore, we clarify that if on-duty staff and sheltered patients are relocated during the emergency, the provider or supplier must document the specific name and location of the receiving facility or other location. Unlike inpatient facilities, PRTFs, ICF/IIDs, and LTC facilities are residential facilities and serve as the patient's home, which is why in these settings we refer to the patients as “residents.” Similar to these residential facilities ESRD facilities, CMHCs, and PACE organizations, provide a continuum of care for their patients. Residents and patients of these facilities would anticipate returning to these facilities after an emergency. For this reason, we believe that it is imperative for these facilities to know where their residents/patients and staff are located during and after the emergency to allow for repatriation and the continuation of regularly scheduled appointments.

While we pointed out JPATS as a tool for providers and suppliers, we note that we indicated that we were not proposing a specific type of tracking system that providers and suppliers must use. We also indicated that in the proposed rule that a number of states have tracking systems in place or under development and the systems are available for use by healthcare providers and suppliers. We encourage providers and suppliers to leverage the support and resources available to them through local and national healthcare systems, healthcare coalitions, and healthcare organizations for resources and tools for tracking patients.

We have also reviewed our proposal to require ASCs, hospices, and HHAs to track their staff and patients before and after an emergency. We discuss in detail the comments we received specific to these providers and suppliers and revisions to their proposed tracking requirement in their specific section later in this final rule.

B. Implementation Date

We proposed several variations on an implementation date for the emergency preparedness requirements (78 FR 79179). Regarding the implementation date, we requested information on the following issues:

• A targeted approach to emergency preparedness that would apply the rule to one provider or supplier type or a subset of provider types, to learn from implementation prior to requiring compliance for all 17 types of providers and suppliers.
• A phased-in approach that would implement the requirements over a longer time horizon, or differential time horizons for the different provider and supplier types.

Comment: Most commenters recommended that CMS set a later implementation date for the emergency preparedness requirements. Some commenters recommended that we use a targeted approach, whereby the rule would be implemented first by one provider/supplier type or a subset of provider/supplier types, with later implementation by other provider/supplier types, so they can learn from prior implementation at other facilities. Others recommended that CMS phase in the requirements over a longer time horizon.

Many commenters recommended that CMS require implementation at hospitals or LTC facilities first, so that other facilities could benefit from the experience and lessons learned by these providers. Some of these commenters stated that these providers have the most capacity to implement these requirements. A commenter recommended that hospitals implement the requirements of the rule first, followed by CAHs and other inpatient provider types and LTC facilities. Other provider and supplier types would follow thereafter. The commenter recommended that CMS establish a period of non-enforcement for each implementation phase, while a Phase 1 evaluation is conducted and feedback is given to other facilities.

Several commenters, including major hospital associations, disagreed with CMS' proposal to implement all of the requirements 1 year after the final rule is published. The commenters noted that implementation of all the requirements after 1 year would be burdensome and costly to many facilities. In addition, a few commenters noted that certain facilities, mainly rural and small facilities, may be at a disadvantage because they have not participated in national emergency preparedness planning efforts or because they lack the necessary resources to implement emergency preparedness plans.

A few commenters drew a distinction between accredited and non-accredited facilities and recommended that hospitals implement the requirements within a year or 2 after publication of the final rule. Some of the commenters noted that non-accredited facilities, CAHs, HHAs, and hospices, would need more time. Several of these commenters also stated that hospitals that need more time for implementation should be able to propose to CMS a reasonable period of time to comply. A few commenters stated that the emergency preparedness proposal is unlike the standards utilized by the TJC and that enforcement of these requirements should be at a later date for both accredited and non-accredited facilities.

Some commenters recommended that CMS give ASCs and FQHCs additional time to come into compliance. A commenter recommended that CMS set a later implementation date for the requirements and provide a flexible implementation timeframe based on provider type and resources. A few commenters stated that the implementation timeline is too short for rehabilitation facilities, long-term acute care facilities, LTC facilities, behavioral health inpatient facilities, and ICF/IIDs.

A few commenters recommended that CMS phase-in implementation on a standard-by-standard basis. A commenter recommended that LTC facilities implement the requirements 12 to 18 months after hospitals. Furthermore, the commenter recommended an 18 to 24 month phase-in of emergency systems and a 24 to 38 month phase-in for the training and testing requirements. Another commenter recommended that facilities be allowed to comply with the initial planning requirements within 2 years, and then be allowed to comply with the subsistence and infrastructure requirements in years 3 and 4.

The commenters varied in their recommendations on the timeframe CMS should use for the implementation date. These recommendations ranged from 6 months to 5 years, with a few commenters recommending even longer periods. Some commenters noted that applying a targeted approach, covering one or a subset of provider classes to learn from implementation prior to extending the rule to all groups, would also allow a longer period of time for other provider/supplier types to prepare for implementation. Furthermore, a commenter noted that a phased in approach would help to alleviate the cost burden on facilities that would need to create an emergency plan and train and test staff.

Response: We appreciate the commenters' feedback. We considered a phased-in approach in a number of ways. We looked at phasing in the implementation of various providers and suppliers; and phasing in the various standards of the regulation. We concluded that this approach would be too difficult to implement, enforce, and evaluate. Also, this would not allow communities to have a comprehensive approach to emergency preparedness. However, we agree that there should be a later implementation date for the emergency preparedness requirements. However, we do not believe that a targeted or phased-in approach to implementation is appropriate. One thing we proposed and are now finalizing to address this concern is extending the implementation timeframe for the requirements to 1 year after the effective date of this final rule (see section section II, Provisions of the Proposed Rule and Responses to Public Comments, part B, Implementation Date). We believe it is imperative that each provider thinks in terms broader than their own facility, and plan for how they would serve similar and other healthcare facilities as well as the whole community during and surrounding an emergency event. To encourage providers to develop a comprehensive and coordinated approach to emergency preparedness, all providers need to adopt the requirements in this final rule at the same time.

Commenters have stated that hospitals that are TJC-accredited are part of the Hospital Preparedness Program (HPP) program, and those hospitals that follow National Fire Protection Association (NFPA®) standards, have already established most of the emergency preparedness requirements set out in this rule. Based on CDC's National Health Statistics Reports; Number 37, March 24, 2011, page 2 (NCHS-2008PanFluandEP_NHAMCSSurveyReport_2011.pdf), about 67.9 percent of hospitals had plans for all six hazards (epidemic-pandemic, biological, chemical, nuclear-radiological, explosive-incendiary, and natural incidents). Nearly all hospitals (99.0 percent) had emergency response plans that specifically addressed chemical accidents or attacks, which were not significantly different from the prevalence of plans for natural disasters (97.8 percent), epidemics or pandemics (94.1 percent), and biological accidents or attacks. However, we also believe that other facilities will be ready to begin implementation of these rules at the same time as hospitals. We believe that most facilities already have some basic emergency preparedness requirements that can be built upon to meet the requirements set out in this final rule. We note that we have modified or eliminated some of our proposed requirements for certain providers and suppliers, as discussed later in this final rule, which should ease concerns about implementation. Therefore, we believe that all affected providers and suppliers will be able to comply with these requirements 1 year after the final rule is published.

We do not believe a period of non-enforcement is appropriate as it will further prolong the implementation of necessary and life-saving emergency preparedness planning requirements by facilities. A later implementation date will leave the most vulnerable patient populations and unprepared facilities without a valuable, life-saving emergency preparedness plan should an emergency arise. We have not received comments that persuaded us that a later implementation date for these requirements of more than 1 year is beneficial or appropriate for providers and suppliers or their patients.

In response to commenters that opposed our proposal to implement the requirements 1 year after the final rule was published and recommended that we afford facilities more time to implement the requirements, we do not believe that the requirements will be overly burdensome or overly costly to providers and suppliers. We note, as we have heard from many commenters, that many facilities already have established emergency preparedness plans, as required by accrediting organizations. However, we acknowledge that there may be a significant amount of work that small facilities and those with limited resources will need to undertake to establish an emergency preparedness plan that conforms to the requirements set out in this regulation. However, we believe that prolonging the requirements in this final rule by 1 year will provide sufficient time for implementation among the various facilities to meet the emergency preparedness requirements. We encourage facilities to engage and collaborate with their local partners and healthcare coalitions in their area for assistance. Facilities may also access ASPR's TRACIE web portal, which is a healthcare emergency preparedness information gateway that helps stakeholders at the federal, state, local, tribal, non-profit, and for-profit levels have access to information and resources to improve preparedness, response, recovery, and mitigation efforts. ASPR TRACIE, located at: https://asprtracie.hhs.gov/ , is an excellent resource for the various CMS providers and suppliers as they seek to implement the enhanced emergency preparedness requirements. We encourage facilities to engage and collaborate with their local partners and healthcare coalitions in their area for technical assistance as they include local experts and can provide regional information that can inform the requirements as set forth.

Comment: Some commenters recommended that CMS implement all of the emergency preparedness requirements 1 year after the final rule is published. Other commenters recommended that CMS implement the requirements as soon as the final rule is published or set an implementation date that is less than 1 year from the effective date of this final rule. A few of these commenters, including a major beneficiary advocacy group, stated that implementation should begin as soon as practicable, or immediately after the final rule is published and cautioned against a later implementation date that may leave facilities without important emergency preparedness plans during an emergency.

Some of these commenters stated that hospitals in particular already have emergency preparedness plans in place and are well equipped and prepared to implement the requirements set out in these regulations over the course of a year. Some commenters noted that most hospitals are fully aware of the 4 emergency preparedness requirements set out in the proposed rule through current accreditation standards. Furthermore, the commenters noted that these four requirements would not impose any additional burdens on hospitals. A few commenters acknowledged that some hospitals are not under the purview of an accrediting agency and therefore may need up to 1 year to implement the requirements.

Response: We appreciate the commenters' feedback. We agree with the commenters' view that implementation of the requirements should occur 1 year after the final rule is published for all 17 types of providers and suppliers. We believe that an implementation date for these requirements that is 1 year after the effective date of this final rule will allow all facilities to develop an emergency preparedness plan that meets all of the requirements set out within these regulations. While we understand why some commenters would want these requirements to be implemented shortly after publication of the final rule, we also understand some commenters' concerns about that timeframe. We believe that facilities will need a period of time after the final rule is published to plan, develop, and implement the emergency preparedness requirements in the final rule. Accordingly, we believe that 1 year is a sufficient amount of time for facilities to meet these requirements.

Comment: A few commenters recommended that CMS include a provision that would allow facilities to apply for additional time extensions or waivers for implementation. A commenter recommended that CMS allow facilities to rely on their existing policies if the facility can demonstrate that the existing policies align with the emergency preparedness plan requirements and achieve a similar outcome.

Response: We do not agree with including a provision that will allow for facilities to apply for extensions or waivers to the emergency preparedness requirements. We believe that an implementation date that is beyond 1 year after the effective date of this final rule for these requirements is inappropriate and leaves the most vulnerable facilities and patient populations without life-saving emergency preparedness plans.

However, we do understand that some facilities, especially smaller and more rural facilities, may experience difficulties developing their emergency preparedness plans. Therefore, we believe that setting an implementation date of 1 year after the effective date of this final rule for these requirements will give these and other facilities sufficient time for compliance. As stated earlier, we encourage facilities to form coalitions in their area for assistance in meeting these requirements. We also encourage facilities to utilize the many resources we have included in the proposed and final rule.

We appreciate that some facilities have existing emergency preparedness plans. However, all facilities will be required to develop and maintain an emergency preparedness plan based on an all-hazards approach and address the four major elements of emergency preparedness in their plan that we have identified in this final rule. Each facility will be required to evaluate its current emergency preparedness plan and activities to ensure that it complies with the new requirements.

Comment: A few commenters recommended that CMS implement enforcement of the final rule when the interpretive guidance (IG) is finalized by CMS. A few commenters noted that this implementation data should include a period of engagement with hospitals and other providers and suppliers, a period to allow for the development and testing of surveyor tools, and a readiness review of state survey agencies that is complete and publicly available. A commenter recommended that facilities implement the requirements 5 years after the IGs have been published. Another commenter recommended that CMS phase-in implementation in terms of enforcement and roll out, allowing time for full implementation and assistance to facilities and state surveyors.

A few commenters recommended that providers be allowed a period of time where they are held harmless during a transitional planning period, where providers may be allotted more time to plan and implement the emergency preparedness requirements.

Response: We disagree with the commenter's recommendations that we should implement this regulation after the IGs have been published. Additionally, we disagree with the recommendation that CMS phase in enforcement or hold facilities harmless for a period of time while the requirements are being implemented, and we do not believe that it is appropriate to implement the CoPs after the IGs are established. The IGs are subregulatory guidelines which establish our expectations for the function states perform in enforcing the regulatory requirements. Facilities do not require the IGs in order to implement the regulatory requirements. We note that CMS historically releases IGs for new regulations after the final rule has been published. This EP rule is accompanied by extensive resources that providers and suppliers can use to establish their emergency preparedness programs. In addition, CMS will create a designated Web site for the Emergency Preparedness Rule at https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/index.html that will house information for providers, suppliers and surveyors. The Web site will contain the link to the final rule and will also include templates, provider checklists, sample emergency preparedness plans, disaster specific information and lessons learned. CMS will also be releasing an all-hazards FAQ document that will be posted to Web site as well. We will also continue to communicate with providers and other stakeholders about these requirements through normal channels. For example we will communicate with surveyors via Survey and Certification memoranda and provide information to facilities via, provider forums, press releases and Medicare Learning Network publications. We continue to believe that setting a later implementation date for the enforcement of these requirements will leave the most vulnerable patient populations and unprepared facilities without valuable, life-saving emergency preparedness plans should an emergency arise. One year is a sufficient amount of time for facilities to meet these requirements.

Comment: Several commenters, including national and local organizations, and providers, supported using a transparent process in the development of interpretive guidelines for state surveyors. They suggested consulting with industry experts, healthcare organizations, accrediting bodies and state survey agencies in the development of clear and concise interpretation and application of the IGs nationwide. One provider suggested that CMS post the draft guidance electronically for a period of time and provide an email address for stakeholders to offer comments. Furthermore, this provider suggested that the guidance be pilot-tested and revised prior to adoption.

Response: We thank the commenters for their suggestions. In addition to the CoPs/CfCs, IGs will be developed by CMS for each provider and supplier types. We also note that surveyors will be provided training on the emergency preparedness requirements so that enforcement of the rule will be based on the regulations set forth here. While comments on the process for developing the interpretive guidelines is outside the scope of this proposed rule, we agree that consistency and conciseness in the IGs is critical in the evaluation process for providers and suppliers in meeting these emergency preparedness requirements.

Comment: A few commenters recommended that CMS allow multiple facility types that are administered by the same owner to obtain waivers of specific requirements or have a single multi-facility plan approved, if they can collectively adopt a functionally equivalent strategy based on the requirements that may apply to one of their facility types. The commenters note that operation of more than one facility type is not uncommon among Tribal health programs.

Response: Although we disagree with the commenter's recommendation that we allow multiple facility types that are administered by the same owner to obtain implementation waivers of specific requirements, we agree that multiple facilities that are administered by the same owner, that effectively operate as an integrated health system, can have a unified emergency preparedness program. We previously discussed this final policy in the Integrated Health System section of this final rule.

Comment: A commenter recommended that the states take the lead on determining the timing of implementation for various providers and suppliers.

Response: We do not believe that State governments or State agencies should determine the timing of implementation for facilities' emergency preparedness plans. While the State government will provide valuable resources during a disaster, CMS is responsible for the implementation of the federal regulations for Medicare and Medicaid certified providers and suppliers. Furthermore, it will be difficult for survey agencies to monitor the requirements in this rule if each State has different implementation timelines. As stated previously, we believe that most providers have basic emergency preparedness plans and protocols and that they are capable of implementing the requirements within 1 year after the final rule is published.

After consideration of the comments received, we are finalizing our proposal, without modification, to require implementation of all of the requirements for all providers and suppliers 1 year after the final rule is published.

C. Emergency Preparedness Regulations for Hospitals (§ 482.15)

Our proposed hospital regulatory scheme was the basis for all other proposed emergency preparedness requirements as set out in the proposed rule. Since application of the proposed regulatory language for hospitals would be inappropriate or overly burdensome for some facilities, we tailored specific proposed requirements to each providers' and suppliers' unique situation. In the December 2013 proposed rule we provided a detailed discussion of each proposed hospital requirement, as well as resources that facilities could use to meet the proposed requirements, a methodology to establish and maintain emergency preparedness, and links to guidance materials and toolkits that could be used to help meet the requirements. We encourage readers to refer to the proposed rule for this detailed discussion.

As previously discussed, many commenters commented on the proposed regulations for hospitals, but indicated that their comments could also be applied to the additional provider and supplier types. Therefore, where appropriate, we collectively refer to hospitals and the other providers and suppliers as “facilities” in this section of the final rule.

1. Risk Assessment and Emergency Plan (§ 482.15(a))

Section 1861(e) of the Act defines the term “hospital” and subsections (1) through (8) list requirements that a hospital must meet to be eligible for Medicare participation. Section 1861(e)(9) of the Act specifies that a hospital must also meet such other requirements as the Secretary finds necessary in the interest of the health and safety of individuals who are furnished services in the institution. Under the authority of 1861(e) of the Act, the Secretary has established in regulations at 42 CFR part 482 the requirements that a hospital must meet to participate in the Medicare program.

Section 1905(a) of the Act provides that Medicaid payments may be applied to hospital services. Regulations at §§ 440.10(a)(3)(iii) and 440.140 require hospitals, including psychiatric hospitals, to meet the Medicare CoPs to qualify for participation in Medicaid. The hospital and psychiatric hospital CoPs are found at §§ 482.1 through 482.62.

Services provided by hospitals encompass inpatient and outpatient care for persons with various acute or chronic medical or psychiatric conditions, including patient care services provided in the emergency department. Hospitals are often the focal points for healthcare in their respective communities; thus, it is essential that hospitals have the capacity to respond in a timely and appropriate manner in the event of a natural or man-made disaster. Additionally, since Medicare-participating hospitals are required to evaluate and stabilize every patient seen in the emergency department and to evaluate every inpatient at discharge to determine his or her needs and to arrange for post-discharge care as needed, hospitals are in the best position to coordinate emergency preparedness planning with other providers and suppliers in their communities.

We proposed a new requirement under § 482.15 that would require hospitals to have both an emergency preparedness program and an emergency preparedness plan. To ensure that all hospitals operate as part of a coordinated emergency preparedness system, we proposed at § 482.15 that all hospitals establish and maintain an emergency preparedness plan that complies with both federal and state requirements. Additionally, we proposed that the emergency preparedness plan be reviewed and updated at least annually. As part of an annual review and update, staff are required to be trained and be familiar with many policies and procedures in the operation of their facility and are held responsible for knowing these requirements. Annual reviews help to refresh these policies and procedures which would include any revisions to them based on the facility experiencing an emergency or as a result of a community or natural disaster.

In keeping with the focus of the emergency management field, we proposed that prior to establishing an emergency preparedness plan, the hospital and all other providers and suppliers would first perform a risk assessment based on using an “all-hazards” approach. Rather than managing planning initiatives for a multitude of threat scenarios all-hazards planning focuses on developing capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters. Thus, all-hazards planning does not specifically address every possible threat but ensures those hospitals and all other providers and suppliers will have the capacity to address a broad range of related emergencies.

We stated that it is imperative that hospitals perform all-hazards risk assessment consistent with the concepts outlined in the National Preparedness System, published by the United States (U.S.) Department of Homeland Security, as well as guidance provided by Agency for Healthcare Research and Quality (AHRQ), to help hospital planners and administrators make important decisions about how to protect patients and healthcare workers and assess the physical components of a hospital when a natural or manmade disaster, terrorist attack, or other catastrophic event threatens the soundness of a facility. We also provided additional guidance and resources for assistance with designing and performing a hazard vulnerability assessment.

In the proposed rule (78 FR 79094), we stated that in order to meet the proposed requirement for a risk assessment at § 482.15(a)(1), we would expect hospitals to consider, among other things, the following: (1) Identification of all business functions essential to the hospitals operations that should be continued during an emergency; (2) identification of all risks or emergencies that the hospital may reasonably expect to confront; (3) identification of all contingencies for which the hospital should plan; (4) consideration of the hospital's location, including all locations where the hospital delivers patient care or services or has business operations; (5) assessment of the extent to which natural or man-made emergencies may cause the hospital to cease or limit operations; and (6) determination of what arrangements with other hospitals, other healthcare providers or suppliers, or other entities might be needed to ensure that essential services could be provided during an emergency.

We proposed at § 482.15(a)(2) that the emergency plan include strategies for addressing emergency events identified by the risk assessment. For example, a hospital in a large metropolitan city may plan to utilize the support of other large community hospitals as alternate care placement sites for its patients if the hospital needs to be evacuated. However, we would expect the hospital to have back-up evacuation plans for circumstances in which nearby hospitals also were affected by the emergency and were unable to receive patients.

At § 482.15(a)(3), we proposed that a hospital's emergency plan address its patient population, including, but not limited to, persons at-risk. We also discussed in the preamble of the proposed rule that “at-risk populations” are individuals who may need additional response assistance, including those who have disabilities, live in institutionalized settings, are from diverse cultures, have limited English proficiency or are non-English speaking, lack transportation, have chronic medical disorders, or have pharmacological dependency. According to the section 2802 of the PHS Act (42 U.S.C. 300hh-1) as added by Pandemic and All-Hazards Preparedness Act (PAHPA) in 2006, in “at-risk individuals” means children, pregnant women, senior citizens and other individuals who have special needs in the event of a public health emergency as determined by the Secretary. In 2013, the Pandemic and All-Hazards Preparedness Reauthorization Act (PAHPRA) amended the PHS Act ( http://www.gpo.gov/fdsys/pkg/PLAW-113publ5/pdf/PLAW-113publ5.pdf ) and added that consideration of the public health and medical needs of “at-risk individuals” includes taking into account the unique needs and considerations of individuals with disabilities. The National Response Framework (NRF), the primary federal document guiding how the country responds to all types of disasters and emergencies, includes in its description of “at-risk individuals” children, individuals with disabilities and others with access and functional needs; those from religious, racial and ethnically diverse backgrounds; and people with limited English proficiency. We have included additional examples of at-risk populations, including definitions from both PHS Act and NRF and have expanded the definition to include examples used in the healthcare industry. We have stated that the patient population may not be limited to just persons at-risk but may include, for example, descriptions of patient populations unique to their geographical areas, such as CMHCs and PRTFs. The definition of at-risk populations provided in the regulation text is to include all of the populations discussed in the NRF and PHS Act definitions and are defined within the individual providers and suppliers included in this regulation.

We also proposed at § 482.15(a)(3) that a hospital's emergency plan address the types of services that the hospital would be able to provide in an emergency. In regard to emergency preparedness planning, we also proposed at § 482.15(a)(3) that all hospitals include delegations and succession planning in their emergency plan to ensure that the lines of authority during an emergency are clear and that the plan is implemented promptly and appropriately.

Finally, at § 482.15(a)(4), we proposed that a hospital have a process for ensuring cooperation and collaboration with local, tribal, regional, state, or federal emergency preparedness officials' efforts to ensure an integrated response during a disaster or emergency situation, including documentation of the hospital's efforts to contact such officials and, when applicable, its participation in collaborative and cooperative planning efforts. We stated that we believed planning with officials in advance of an emergency to determine how such collaborative and cooperative efforts would achieve and foster a smoother, more effective, and more efficient response in the event of a disaster. Providers and suppliers must document efforts made by the facility to cooperate and collaborate with emergency preparedness officials.

Comment: A few commenters stated that the term “all-hazards” is too broad and instead should be geared towards possible emergencies in their geographical area. The commenters stated that the term “all-hazards” should be replaced with “Hazard Vulnerability Assessment” (HVA) to be more in line with the current emergency preparedness industry language that providers and suppliers are more familiar. Commenters suggested that CMS align the final rule with the current requirements of accreditation organizations. Some commenters requested clarification as to what an HVA is and how it is performed. Furthermore, commenters encouraged us to discuss the risks or emergencies that a hospital may expect to confront. They recommended adding language to require that the hospital's emergency plan be based on an HVA utilizing an all-hazards approach that identifies the emergencies that the hospital may reasonably expect to confront.

Response: In “An All Hazards Approach to Vulnerable Populations Planning” by Charles K.T. Ishikawa, MSPH, Garrett W. Simonsen, MSPS, Barbara Ceconi, MSW, and Kurt Kuss, MSW (see https://apha.confex.com/apha/135am/webprogram/Paper160527.html ), the researchers described an all hazards planning approach as “a more efficient and effective way to prepare for emergencies. Rather than managing planning initiatives for a multitude of threat scenarios, all hazards planning focuses on developing capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters.” Thus, all-hazards planning does not specifically address every possible threat but ensures that hospitals and all other providers will have the capacity to address a broad range of related emergencies. In the proposed rule, we referred to a “hazard vulnerability risk assessment” as a “risk assessment” that is performed using an all-hazards approach. However, we understand that some providers use the term “hazard vulnerability assessment “(HVA) while other providers and federal agencies use terms such as “all-hazards self-assessment” or “all-hazards risk assessment” to describe the process by which a provider will assess and identify potential gaps in its emergency plan(s). The providers and suppliers discussed in this regulation should utilize an all-hazards approach to perform a “hazard vulnerability risk assessment.” While those providers and suppliers that are more advanced in emergency preparedness will be familiar with some of the industry language, we believe that some providers/suppliers might not have a working knowledge of the various terms; therefore, we used language defining risk assessment activities that would be easily understood by all providers and suppliers that are affected by this regulation and align with the national preparedness system and terminology.

Comment: We received many comments on our proposed changes to require hospitals to develop an emergency plan utilizing an all-hazards approach based on a facility- and community-based risk assessment from individuals, national and state professional organizations, accreditation organizations, individual and multi-hospital systems, and national and state hospital organizations.

Some commenters recommended adding “local” after applicable federal and state emergency preparedness requirements since some states already have local laws and regulations governing their emergency management activities. There was concern voiced that several of CMS' proposals may conflict or overlap with state and local laws and requirements. They recommended that CMS should defer to state and local standards where the proposed CoPs and CfCs would overlap with, be less stringent than, or conflict with those standards.

Response: While we agree that the responsibility for ensuring a community-wide coordinated disaster preparedness response is under the state and local emergency authorities, healthcare facilities will still be required to perform a risk assessment, develop an emergency plan, policies and procedures, communication plan, and train and test all staff to comply with the requirements in this final rule. We disagree that we should defer to state and local standards for emergency preparedness. Also, we do not believe that these requirements will conflict with any state and local standards. These emergency preparedness requirements are the minimal requirements that facilities must meet in order to be in compliance with the emergency preparedness CoPs/CfCs. However, facilities have the option of including as part of their requirements, additional state, local and facility based standards. In particular, the new requirements will require a coordinated and collaborative relationship with state and local governments during a disaster. As such, we agree with the commenters that it is appropriate to add the word “local” in the introductory paragraph for the emergency preparedness requirements. For consistency within the regulation, we will also add the term “local” to the communication plan requirements throughout the regulation.

Comment: Some commenters expressed concern that the term “emergency preparedness program” was discussed in the preamble and then the regulation text used the term “Emergency preparedness plan,” and they thought the use of both terms was confusing, a duplication of efforts and a strain on limited resources. Some thought the plan included policies and procedures and training and did not refer to the term “program.” Some commenters questioned whether the proposed rule required hospitals to have both an emergency preparedness program and an emergency preparedness plan and questioned if documentation was required for both. They recommended that CMS should clearly stipulate in its standards that only one document is required to demonstrate compliance with the standards.

Some commenters believed that the emergency preparedness policies and procedures based on the emergency plan and risk assessment could be a potential duplication of effort. They recommended that CMS only require healthcare organizations to document how they will meet the emergency preparedness standards in the emergency preparedness plan, and not require separate policies and procedures. They stated that the concept of an emergency preparedness plan is equivalent to a policy, and the emergency preparedness plan states how the hospital will meet a standard.

Response: We agree that the words “program” and “plan” are often used interchangeably. However, in this final rule we use the word “program” to describe a facility's comprehensive approach to meeting the health and safety needs of their patient population during an emergency. We use the word “plan” to describe the individual components of the program such as an emergency plan, policies and procedures, a communication plan, testing and training plans. Regardless of the various synonyms for the words “program” or “plan”, we expect a facility to have a comprehensive emergency preparedness program that addresses all of the required elements. An emergency program could be implemented if an internal emergency occurred, such as a flood or fire in the facility, or if a community emergency occurred, such as a tornado, hurricane or earthquake. However, for the purpose of this rule, an emergency or a disaster is defined as an event that affects the facility or overall target population or the community at large or precipitates the declaration of a state of emergency at a local, state, regional, or national level by an authorized public official such as a Governor, the Secretary of the Department of Health and Human Services (DHHS), or the President of the United States.

An emergency plan is one part of a facility's emergency preparedness program. The plan provides the framework, which includes conducting facility-based and community-based risk assessments that will assist a facility in addressing the needs of their patient populations, along with identifying the continuity of business operations which will provide support during an actual emergency. In addition, the emergency plan supports, guides, and ensures a facility's ability to collaborate with local emergency preparedness officials. As a separate standard, facilities will be required to develop policies and procedures to operationalize their emergency plan. Such policies and procedures should include more detailed guidance on what their staff will need to develop and operationalize in order to support the services that are necessary during an actual emergency.

Comment: Some commenters stated that the requirement to update the policies and procedures annually was excessive. Some suggested review only as needed, and several thought this requirement was burdensome. Some commenters suggested that the plan should only be reviewed after an emergency event occurred. A few suggested that only the necessary administrative personnel would need to review the plan according to their policy. Some commenters suggested that weather-related emergencies be reviewed and updated seasonally or quarterly.

Response: We disagree that an annual update is excessive or overly burdensome. We believe it is good business practice to review and evaluate at least annually for revisions that will improve the care of patients, staff and local communities. It is important to keep facility staff updated and trained, as evidenced by policy and procedural updates often occurring not only as a result of an emergency that the facility experienced, but as has been noted in the local and international news. For example, there are various infections and diseases, such as the Ebola outbreak in October, 2014, that required updates in facility assessments, policies and procedures and training of staff beyond the directly affected hospitals. The final rule requires that if a facility experiences an emergency, an analysis of the response and any revisions to the emergency plan will be made and gaps and areas for improvement should be addressed in their plans to improve the response to similar challenges for any future emergencies.

Comment: Some commenters viewed the organization of the emergency plan in the proposed rule as separate from the emergency preparedness policies and procedures. Some hospitals have an emergency plan that consists of emergency policies and procedures in a single document that is updated periodically. They recommended that CMS recognize that the plan may represent the policies and procedures.

Response: The format of the emergency preparedness plan and emergency policies and procedures that a hospital or facility uses are at their discretion. However, it must include all the requirements included for the emergency plan and for the policies and procedures.

Comment: A commenter questioned why mitigation was not included in the risk assessment process as part of the evaluation in reviewing the strategies used during an emergency as related to possible future similar events. The commenter noted that FEMA provides resources, including grant programs, for mitigation planning for communities. According to FEMA documents, assistance from local emergency management officials is available in identifying hazards in their community, and recommending options to address them. A few commenters recommended that we modify the regulation to include mitigation.

Response: We understand the commenters' concerns, however our new emergency preparedness requirements focus on continuity of operations, not hazard mitigation, which refers to actions to reduce to eliminate long term risk to people and property from natural disasters. The emergency plan requires facilities to include strategies for addressing the identified emergency events that have been developed from the facility and the community-based risk assessments. These strategies include addressing changes that have resulted from evaluating their risk assessment process. We decided to not include specific mitigation requirements as part of the emergency plan and instead, base the plan on using an all-hazards approach which can include mitigation activities to lessen the severity and impact a potential disaster or emergency can have on a health facility's operation. Facilities can choose to include hazard mitigation strategies in their emergency preparedness plan. However, we have not made hazard mitigation a requirement. We refer commenters that are interested in hazard mitigation to the following resources for more information:

• National Mitigation Framework: http://www.fema.gov/national-mitigation-framework .
• FEMA Hazard Mitigation Planning: http://www.fema.gov/hazard-mitigation-planning .

Comment: Commenters agreed that a hospital should evaluate both community-based and facility-based risks but did not believe that CMS provided enough clarity about which entity is expected to conduct the community-based risk assessment. It is unclear whether CMS would expect a hospital to conduct its own assessment outside of the hospital or rely on an assessment developed by entities, such as regional healthcare coalitions, public health agencies, or local emergency management. The commenters suggested that CMS allow hospitals to develop a hazard vulnerability risk assessment by a different organization if deemed adequate or conduct their own assessment with input from key organizations as is consistent with TJC and NFPA® standards.

Response: We agree that a hospital could rely on a community-based assessment developed by other entities, such as their public health agencies, emergency management agencies, and regional healthcare coalitions or in conjunction with conducting its own facility-based assessment. We would expect the hospital to have a copy of this risk assessment and to work with the entity that developed it to ensure that the hospital emergency plan is in alignment.

Comment: Some commenters questioned if the proposed rule would allow an aggregation of risk assessments for multiple sites.

Response: As discussed previously, we are allowing integrated plans for integrated health systems. Please refer to the “Integrated health Systems” section of this final rule for further information.

Comment: Some commenters thought “The National Planning Scenarios” discussed in the proposed rule were a good tool, but the risk assessment developed at the organizational level should be the driving force behind the emergency plan. It was recommended that we clarify that the scenarios are merely variables that could be considered in addition to the organization's risk assessment of potential local threats.

Response: We agree with the commenters. In accordance with § 482.15(a)(1), the hospital must develop an emergency plan based on a risk assessment. As stated in the proposed rule, The National Planning Scenarios were suggested as a possible tool that facilities could consider in the development of their emergency plan along with the development of the facility and community risk assessments.

Comment: Some commenters believed the examples listed in the preamble addressing patient populations, including persons at-risk, were not comprehensive enough and requested that more categories be included. Some stated that a “patient population” included all patients; otherwise, they would not be in a facility receiving treatment or care. The commenters suggested that at-risk populations (geriatric, pediatric, disabled, serious chronic conditions, addictions, or mental health issues) served in all provider settings receive similar emphasis in guidance. A commenter stated that the at-risk definition should be limited to those persons who are identified by statute or who are assessed by the provider as being vulnerable due to physical and cognitive functioning impairments. Some commenters were concerned that the wording of the regulation could create the expectation that hospitals would be required to care for all individuals in the community who had additional needs. They believed community-wide planning should ensure that alternate locations be established for such things as individuals dependent on medical equipment that requires electricity for recharging their equipment. Some commenters suggested adding language “of providing acute medical care and treatment in an emergency to describe the services that they will have the ability to provide to their patient population.”

Response: In the proposed rule, several types of patient populations were described as at-risk. More examples would have required an exhaustive list and even then, not all categories would have been included. Other suggested categories, as set out in the comment, could be included in the individual facility's assessments and would not be limited to the examples listed in the proposed rule.

As is often the case, in times of emergency, people seek assistance at general hospitals for such things as charging batteries for their medical equipment, and obtaining medical supplies such as oxygen, which they need for their care. The commenters' suggestion that community-wide alternate locations be established to handle these needs would need to be arranged with their local emergency preparedness officials. To facilitate that, the proposed rule requires a process for ensuring cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials in order to ensure an integrated response during a disaster or emergency situation. Facilities are encouraged to participate in a local healthcare coalition as it may provide assistance in planning and addressing broader community needs that may also be supported by local health department and emergency management resources. Facilities may include establishing community-wide alternate locations in their facility plan. Individual facilities would not be expected to take care of all the needs in the community during an emergency.

Comment: Several commenters stated that we did not require facilities to evaluate strategies for addressing surge capacity within the initial risk assessment. They suggested that we require facilities to address surge capacity in their emergency plans. Another commenter stated that facilities should develop specialized plans to address the needs of their patients with disabilities or who are medically dependent (for example, patients requiring dialysis or ventilator).

Response: We believe that an emergency preparedness plan based on an all-hazards risk assessment would include plans for the potential of surge activities during an emergency. The emergency plan should also consider the needs of the entire patient and staff populations.

Comment: Commenters requested clarification about what is meant by “type of services” the provider/suppliers have the ability to provide in an emergency.

Response: Based on the emergency situation and the facility's available resources, a facility would need to assess its capabilities and capacities in order to determine the type of care and treatment that could be offered at that time based on its emergency preparedness plan.

Comment: Some facilities questioned how they could include a process for ensuring cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials' efforts to ensure an integrated response during a disaster or emergency situation. Some commenters stated that they already had this requirement in their states' regulations and were already familiar with the process. Many commenters believed the term “ensuring” was too onerous for providers and suppliers and CMS did not take into consideration that the State and local emergency officials also had responsibilities. A commenter suggested adding language: “with the goal of implementing an integrated response during a disaster or emergency situation, including documentation of the hospital's efforts to contact such officials and when applicable, its participation in collaborative and cooperative planning efforts.” Several commenters recommended replacing the word “ensure” with the words “strive for.” Some believed this requirement was important but with limited funds available, implementation would be excessively burdensome.

Response: As noted previously, some commenters stated that they were already familiar with the process for ensuring cooperation and collaboration with various levels of emergency preparedness officials. Providers and suppliers must document efforts made by the facility to cooperate and collaborate with emergency preparedness officials. While we are aware that the responsibility for ensuring a coordinated disaster preparedness response lies upon the state and local emergency planning authorities, we have stated previously in this rule that providers and suppliers must document efforts made by the facility to cooperate and collaborate with emergency preparedness officials. Since some aspects of collaborating with various levels of government entities may be beyond the control of the provider/supplier, we have stated that these facilities must include in their emergency plan a process for cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials.

Comment: A commenter suggested that CMS take into account potential language barriers that may occur in rural areas during an emergency. The commenters recommended that CMS include a requirement for a formal interpreter to interact with non-English speaking patients during an emergency.

Response: Facilities are required to have an emergency preparedness plan that addresses the usual patient population of the community the hospital serves. In addition, certified Medicare providers and suppliers are required to provide meaningful access to Limited English Proficient (LEP) persons under the provider agreement and supplier approval requirement (§ 489.10), to comply with Title VI of the Civil Rights Act of 1964. Title VI requires Medicare participants to take reasonable steps to ensure meaningful access to their programs and activities by LEP persons.

Comment: A commenter stated that the risk assessment should include the availability of emergency power or a plan for ensuring emergency power with the owner of a building in which the facility operates when a facility is not owned by the provider.

Response: It is the responsibility of the healthcare provider that is renting a facility to discuss issues of ensuring that they can continue to provide healthcare during an emergency if the structure of the building and its utilities are impacted. We would expect providers to include this in their risk assessment. As discussed in the next section, we require facilities to develop policies and procedures to address alternate sources of energy.

After consideration of the comments we received on the proposed rule, we are finalizing our proposal with the following modifications:

• Revising the introductory text of § 482.15 by adding the term “local” to clarify that hospitals must also coordinate with local emergency preparedness systems.
• Revising § 482.15(a)(4) to remove the word “ensuring” and replacing the word “ensure” with “maintain.”

2. Policies and Procedures (§ 482.15(b))

We proposed at § 482.15(b) that a hospital be required to develop and implement emergency preparedness policies and procedures based on the emergency plan proposed at § 482.15(a), the risk assessment proposed at § 482.15(a)(1), and the communication plan proposed at § 482.15(c). We proposed that these policies and procedures be reviewed and updated at least annually.

We proposed at § 482.15(b)(1) that a hospital's policies and procedures would have to address the provision of subsistence needs for staff and patients, whether they evacuated or sheltered in place, including, but not limited to, at § 482.15(b)(1)(i), food, water, and medical supplies. We noted that the analysis of the disaster caused by the hurricanes in the Gulf States in 2005 revealed that hospitals were forced to meet basic subsistence needs for community evacuees, including visitors and volunteers who sheltered in place, resulting in the rapid depletion of subsistence items and considerable difficulty in meeting the subsistence needs of patients and staff. Therefore, we proposed that a hospital's policies and procedures also address how the subsistence needs of patients and staff that were evacuated would be met during an emergency.

At § 482.15(b)(1)(ii) we proposed that the hospital have policies and procedures that address the provision of alternate sources of energy to maintain: (1) Temperatures to protect patient health and safety and for the safe and sanitary storage of provisions; (2) emergency lighting; and (3) fire detection, extinguishing, and alarm systems. At § 482.15(b)(1)(ii)(D), we proposed that the hospital develop policies and procedures to address the provisions of sewage and waste disposal including solid waste, recyclables, chemical, biomedical waste, and waste water.

At § 482.15(b)(2), we proposed that the hospital develop policies and procedures regarding a system to track the location of staff and patients in the hospital's care, both during and after an emergency. We stated that it is imperative that the hospital be able to track a patient's whereabouts, to ensure adequate sharing of patient information with other facilities and to inform a patient's relatives and friends of the patient's location within the hospital, whether the patient has been transferred to another facility, or what is planned in respect to such actions. We did not propose a requirement for a specific type of tracking system. We believed that a hospital should have the flexibility to determine how best to track patients and staff, whether it uses an electronic database, hard copy documentation, or some other method. However, we stated that it is important that the information be readily available, accurate, and shareable among officials within and across the emergency response system, as needed, in the interest of the patient and included in their policies and procedures.

We proposed at § 482.15(b)(3) that a hospital have policies and procedures in place to ensure safe evacuation from the hospital, which would include consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance. We proposed at § 482.15(b)(4) that a hospital have policies and procedures to address a means to shelter in place for patients, staff, and volunteers who remain in the facility. We indicated that we would expect that hospitals include in their policies and procedures both the criteria for selecting patients and staff that would be sheltered in place and a description of how they would ensure their safety.

We proposed at § 482.15(b)(5) that a hospital have policies and procedures that would require a system of medical documentation that would preserve patient information, protect the confidentiality of patient information, and ensure that patient records are secure and readily available during an emergency. In addition to the current hospital requirements for medical records located at § 482.24(b), we proposed that hospitals be required to ensure that patient records are secure and readily available during an emergency. We indicated that such policies and procedures would have to be in compliance with Health Insurance Portability and Accountability Act (HIPAA) Rules at 45 CFR parts 160 and 164, which protect the privacy and security of an individual's protected health information. We proposed at § 482.15(b)(6) that facilities have policies and procedures in place to address the use of volunteers in an emergency or other emergency staffing strategies, including the process and role for integration of state or federally designated healthcare professionals to address surge needs during an emergency.

We proposed at § 482.15(b)(7) that hospitals have a process for the development of arrangements with other hospitals and other facilities to receive patients in the event of limitations or cessation of operations at their facilities, to ensure the continuity of services to hospital patients. This requirement would apply only to facilities that provide continuous care and services for individual patients; therefore, we did not propose this requirement for transplant centers, CORFs, OPOs, clinics, rehabilitation agencies, and public health agencies that provide outpatient physical therapy and speech-language pathology services, or RHCs/FQHCs.

We also proposed at § 482.15(b)(8) that hospital policies and procedures would have to address the role of the hospital under a waiver declared by the Secretary, in accordance with section 1135 of the Act, for the provision of care and treatment at an alternate care site identified by emergency management officials. We proposed this requirement for inpatient providers only. We stated that we would expect that state or local emergency management officials might designate such alternate sites, and would plan jointly with local facilities on issues related to staffing, equipment and supplies at such alternate sites. This requirement encourages providers to collaborate with their local emergency officials in proactive planning to allow an organized and systematic response to assure continuity of care even when services at their facilities have been severely disrupted. Under section 1135 of the Act, the Secretary is authorized to temporarily waive or modify certain Medicare, Medicaid, and Children's Health Insurance Program (CHIP) requirements for healthcare providers to ensure that sufficient healthcare items and services are available to meet the needs of individuals enrolled in these programs in an emergency area (or portion of such an area) during any portion of an emergency period. Under an 1135 waiver, healthcare providers unable to comply with one or more waiver-eligible requirements may be reimbursed and exempted from sanctions (absent any determination of fraud or abuse). Additional information regarding the 1135 waiver process is provided in the CMS Survey and Certification document entitled, “Requesting an 1135 Waiver”, located at: http://www.cms.gov/About-CMS/Agency-Information/H1N1/downloads/requestingawaiver101.pdf .

Comment: A commenter stated that we should clarify that if a hospital is destroyed in an emergency but personnel are present with the relevant expertise, then personnel may function within their scope of practice in a makeshift location.

Response: We agree that if a hospital is destroyed in an emergency, the medical personnel of that hospital should be able to function within their scope of practice in an alternate care site to provide valuable medical care. The hospital and other inpatient providers should address this issue in their policies and procedures. These providers, in accordance with section 1135 of the Act, should have policies and procedures for the provision of care and treatment at an alternate care site identified by emergency management officials. We would expect that state or local emergency management officials would plan jointly with local facilities on issues related to staffing, equipment and supplies at such alternate sites.

The comments we received on our proposed requirement for hospitals to develop and implement emergency preparedness policies and procedures are discussed later in this final rule. We also proposed that all providers and suppliers review and update their policies and procedures at least annually. We received a few comments on this issue.

Comment: A few commenters indicated that a requirement for annual updates to the policies and procedures is the most feasible for facilities. A commenter stated that annual updates are not only reasonable, but also necessary in order to ensure that emergency plans and procedures are adequate and current. Other commenters stated that a stricter requirement, for example of bi-annual updates, would be burdensome and unrealistic for facilities to meet. Still other commenters stated that the requirement to update policies and procedures annually was excessive and burdensome. Some suggested review on an “as needed” basis instead. Some suggested that weather-related emergencies be reviewed and updated seasonally or quarterly.

Response: We appreciate the feedback from commenters and we agree that requiring annual updates is effective and the most realistic expectation of facilities. We do not agree that an annual update is excessive or overly burdensome. It is important to keep facility staff updated and trained on emergency policies and procedures regardless of whether the facility has experienced an actual emergency. For example, various infections and diseases, such as the Ebola outbreak in October 2014, have required updates in facility assessments, policies and procedures, and training of staff to ensure the health and safety of their patients and employees. Facilities are free to update as needed but at least annually.

Comment: Most commenters believed that providing for the subsistence needs of patients and staff was appropriate but only if sheltering in place. If patients were evacuated, the receiving facility should be responsible for those needs. Some commenters believed that community organizations, and local emergency management agencies should provide for subsistence needs when patients are sent to the receiving facilities. Some commenters questioned other agencies'/organizations' requirements and how that would impact their current requirements; some questioned whether certain amounts were sufficient and many were concerned about the burden with many facilities operating on limited budgets. Other commenters suggested we should require facilities to have a minimum store of provisions to meet the needs of their patient or resident populations for 72 to 96 hours. The commenters stated that we should clarify the amount of time to provide subsistence during and after an emergency. Other commenters stated that we should not mandate specific subsistence needs and quantities and a few commenters stated that we should delete the requirement for a hospital to provide subsistence in the event of an evacuation.

Response: We would first like to point out that we are requiring certain facilities to have policies and procedures to address the provision of subsistence in the event of an emergency. This does not mean that facilities would need to store provisions themselves. We agree that once patients have been evacuated to other facilities, it would be the responsibility of the receiving facility to provide for the patients' subsistence needs. Local, state and regional agencies and organizations often participate with facilities in addressing subsistence needs, emergency shelter, etc. Secondly, we are not specifying the amount of subsistence that must be provided as we believe that such a requirement would be overly prescriptive. Facilities can best manage this based on their own facility risk assessments. We disagree with setting a rigid amount of subsistence to have on hand at any given time in the event of an emergency. Based on our experience with inpatient healthcare facilities to allow each facility the flexibility to identify the subsistence needs that would be required during an emergency, mostly likely based on level of impact, is the most effective way to address subsistence needs without imposing undue burden.

Comment: In response to a solicitation of public comments in the proposed rule, almost all the facility commenters stated that they did not see subsistence preparations for individuals residing in the larger community as their responsibility. The commenters stated that local and state emergency management personnel along with civic organizations such as the Red Cross should be responsible for meeting these needs. In addition, the cost for the facilities to provide these services to the community would be unsustainable. Some commenters interpreted the proposed regulation text to not only include responsibility for patients and staff in the facility, but also individuals in the community.

Response: We agree with the commenters and did not mean to suggest that facilities are also responsible for individuals in the community. While we believe it would be a good practice to prepare for these “community individuals,” we are not requiring it under § 482.15(b)(1). The provision on subsistence needs applies only for staff and patients.

Comment: Commenters suggested that we add “pharmaceuticals or medications” to provisions of food, water and medical supplies.

Response: We agree with the commenters' suggestion and have added pharmaceuticals to the list of subsistence needs in the regulation text.

Comment: A commenter questioned why supplies, such as personnel, power, water, and finances, are not addressed in relation to subsistence needs in the proposed rule. The commenter noted that the requirements do not include how these supplies will be sustained during emergency situations.

Response: We have included requirements that facilities develop and maintain emergency preparedness policies and procedures that address subsistence needs for staff and patients at § 482.15(b)(1). However, we believe the rule allows flexibility so that facilities can determine how they will acquire provisions and use them for the needs of patients and staff.

Comment: A commenter stated that we should delete the requirement we proposed at § 482.15(b)(4) that a hospital must have policies and procedures to address a means to shelter in place for patients, staff, and volunteers who remain in the facility. The commenter inquired about what a hospital should do with the patients that they decide are not going to be sheltered in place and rescue crews cannot make it to the hospital to remove them.

Response: Plans should be made to shelter all patients in the event that an evacuation cannot be executed. We state at § 482.15(b)(1) that provisions should be made for patients and staff whether they evacuate or shelter in place. However, with advance notice in event of an emergency, it may be medically necessary for some of the patient population to be evacuated in advance. During an emergency, often the hospital may be the only available resource to patients and are the focal points for healthcare in their respective communities. It is essential that hospitals have the capacity to respond in a timely and appropriate manner in the event of a natural or man-made disaster. Since Medicare participating hospitals are required to evaluate and stabilize every patient seen in the emergency department and to evaluate every inpatient at discharge to determine his or her needs and arrange for post-discharge care as needed, hospitals are in the best position to coordinate emergency preparedness planning with other providers and suppliers in their communities. Relief staff may be unable to get to the hospital thus requiring staff to remain at the hospital for indefinite periods of time. We disagree with removing the requirement for facilities to make the necessary plans to provide food, water, medical supplies, and subsistence needs for the patients, staff, and volunteers who remain in the facility. As we have noted previously, the policy only requires that the hospital have policies to provide for subsistence needs, which we believe are not unduly burdensome. We are not setting minimum requirements or standards for these provisions in hospitals.

Comment: A commenter recommended that we require the electronic monitoring of fire extinguishers. The commenter stated that this requirement would address the widespread non-compliance of fire extinguisher code regulations. Another commenter disagreed with the use of electronic monitoring of fire extinguishers, arguing that retrofitting fire extinguishers with this technology would be costly.

Response: This recommendation is not within the scope of this regulation. For additional information we refer readers to our current Life Safety Code regulations (for hospitals, § 482.41(b)).

Comment: In addition to the general comments discussed earlier that we received regarding our proposal for certain providers and suppliers to track staff and patients during and after an emergency, we also received a few comments specific to the tracking requirement for hospitals. Many questioned the complexity of the tracking documentation and what information would be needed. Some commenters stated that patient tracking within the hospital should be distinguished from tracking patients outside of the hospital, in the hospital's care, or whether they are located at an alternate care site operated by the hospital. Moving and tracking of patients may also be the responsibility of an entity other than the hospital, such as state and emergency management officials and the hospitals may not know the destination of the individuals. Some commenters requested clarification regarding what we mean by a “system to track.”

Commenters noted that the facility's tracking system may not be compatible with the hospital's IT system. If the system lacks interoperability, it becomes difficult to share information across the emergency management system. Commenters suggested that CMS change the current language and instead add “a hospital would be required to have a process to locate staff and track the location of patients in the hospital's care both during and throughout the emergency.” Some commenters interpreted the proposed requirement to include the hospital's responsibility of tracking the whereabouts of patients in outpatient facilities (assuming they are part of the hospital). These commenters recommended that CMS remove this requirement.

Response: We appreciate the commenters' feedback and have clarified our expectations. As indicated previously, we have removed “after the emergency” from the regulation text. Furthermore, we are revising the regulation text to clarify that we would expect facilities to track their on-duty staff and sheltered patients during an emergency and document the specific location and name of where a patient is relocated to during an emergency (that is, to another facility, home, or alternate means of shelter, etc.). As we stated in the proposed rule, we did not propose a requirement for a specific type of tracking system. By “system to track” we mean that facilities will have the flexibility to determine how best to track patients and staff, whether they utilize an electronic database, hard copy documentation, or some other method. We would expect that the information would be readily available, accurate, and shareable among officials within and across the emergency response system, as needed, in the interest of the patient.

Comment: Some commenters questioned who would assign evacuation locations outside the facility if it was determined necessary. If internal, they believe the provider or supplier should decide.

Response: Decisions about evacuation locations within a facility should be made by the provider or supplier. If patients must be evacuated outside of the facility, a joint decision could be made by the facility and the local health department and emergency management officials.

Comment: Several commenters stated that the same transportation services may be planned for use by several facilities and that planning should consider multiple options in the event of an evacuation.

Response: We agree with the commenters. We suggest that facilities consider identifying potential redundant transportation options and collaborate with healthcare coalitions to better inform and assist in planning activities for the efficient and effective use of limited resources.

Comment: Some commenters questioned our proposal to shelter volunteers and voiced concern about their legal responsibilities. A commenter stated that it would be challenging for some facilities to provide shelter for patients, staff, and volunteers who remain in the facility. Commenters expressed concern in response to our proposal that hospitals' “shelter-in-place” policies include both the criteria for selecting patients and staff that would be sheltered, and a description of how they would ensure their safety. Some commenters stated that this appeared to lack significant evidence of being an effective policy. The commenters questioned what we expected a hospital to do with the patients that the hospital decides not to shelter in place, if rescue crews could not make it to the hospital to remove them. Other commenters believed hospitals should prepare to shelter in place all patients, staff, and visitors. The commenters recommended that CMS modify its proposal to permit hospitals to decide which patients and staff to shelter.

Response: We agree that sheltering in place can be a challenge to facilities. However, the emergency plan requires strategies for addressing this issue in the facility risk assessment. As such, we disagree with revising our policy for sheltering in place. We require facilities to have a means to shelter in place for patients, staff, and volunteers who remain in the facility. Based on its emergency plan, a hospital could decide to have various approaches to sheltering some or all of its patients, staff and visitors. The plan should take into account the available beds in the area to which patients could be transferred in the event of an emergency. For example, if it is risky or the emergency affects available sites for transfer or discharge, then the patients would remain in the facility until it was safe to transfer or discharge. Also, we would expect providers and suppliers to have policies and guidelines for sheltering volunteers and visitors during an emergency. Facilities must determine their policies based on the emergency and the types of visitors/volunteers that may be present during and after an emergency.

Comment: Some commenters questioned if the system of medical documentation has to be electronic. Some stated that they already have this in place in their facilities. Many stated that electronic health records (EHRs) are not used universally and, if required, would be unrealistic to put into operation for this requirement and would be burdensome to their overall fiscal operation. Many commenters believed multiple IT systems would be incompatible. Some commenters pointed out that if power were lost, they would lose the ability to copy records and use computers to access patient records. Some facility commenters stated that they use paper documents (pre-printed forms) that document relevant patient information and attach them to patients during an evacuation. A commenter believed that some facilities would find it difficult to provide a system of medical documentation that would ensure that medical records were complete, confidential, secure, and readily available. The same commenters stated that it would also be challenging for them to share medical documentation and relevant patient information with other healthcare facilities to ensure continuity of healthcare and treatment during an emergency.

Response: We are not requiring EHRs as part of the medical record documentation requirements. Medicare- and Medicaid-participating facilities are in varying stages of EHR adoption, and therefore, many would be unable to electronically share relevant patient care information with other treating healthcare facilities during an emergency. However, we do expect facilities to be able to provide a means to preserve and protect patient records and ensure that they are secure, in order to provide continuity in the patient's care and treatment. We would expect facilities' plans to address how a provider, in the event of an evacuation, would release patient information, as permitted under 45 CFR 164.510 of the HIPAA Privacy Rule. This section of the HIPAA Privacy Rule sets out “Uses and disclosures requiring an opportunity for the individual to agree or to object.” Facilities should establish an effective communication system, in accordance with the HIPAA Privacy Rule, that could generate timely, accurate information that can be disseminated, as permitted, to family members and others. Facilities should also consider including in their communication plan information on what type of patient information is releasable and who is authorized to release this information during an emergency. Additional information and resources regarding the application of the HIPAA Privacy Rule during emergency scenarios can be located at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/ .

Comment: Some commenters stated that the development of arrangements with hospitals or other providers and suppliers to receive patients in the event of limitation of services, so as to assure continuity of services, was unrealistic, due to limited availability of resources (that is, other hospitals or facilities may be experiencing limitation of services or there are no other providers or suppliers in the area).

Response: We understand that during an emergency other available healthcare resources may be strained, but the development of arrangements in collaboration with other facilities to receive patients is necessary in order to provide the continued needed care and treatment for all patients. If arranged resources are unavailable during an emergency, then the facility should use the available resources in its community. Facilities are encouraged to participate with its local healthcare coalition to gain a broader understanding of other facilities and potential resources, both facility and community, that may be available during an emergency.

Comment: Some commenters stated that any alternate care site should be identified either by the provider or supplier alone or in conjunction with the emergency management officials. A few commenters questioned the legal responsibilities of the staff working at the alternate care site. Some commenters questioned the effect of a waiver on their reimbursement process. Many questions and concerns about staffing responsibilities were related to who would make staffing decisions and who would pay alternate care site salaries. Some commenters stated that the staff could not be spared from their facilities even in emergency circumstances.

Response: Health department and emergency management officials, in collaboration with facility staff, would be responsible for determining the need to establish an alternate care site as part of the delivery of care during an emergency. The alternate care site staff would be expected to function in the capacity of their individual licensure and best practice requirements and laws. Professional staff normally carries malpractice insurance and facilities also have malpractice insurance, which would also include coverage for their employees. Decisions regarding staff responsibilities would be determined based on the facility- and community-based assessments and the type of services staff could provide. This regulation does not address payment issues.

Comment: Many commenters stated that they would be unable to provide or obtain alternative sources of energy during an emergency. They questioned who would decide what are acceptable types of energy sources (such as propane or battery-operated) and what service needs could be met, such as operating rooms, emergency departments, and surgical and intensive care units. Several commenters recommended that CMS state how long a hospital would be expected to provide alternative or backup power.

Response: Alternate sources of energy depend on the resources available to a facility, such as battery-operated lights, propane lights, or heating, in order to meet the needs of a facility during an emergency. We would encourage facilities to confer with local health department and emergency management officials, as well as and healthcare coalitions, to determine the types and duration of energy sources that could be available to assist them in providing care to their patient population during an emergency. As part of the risk assessment planning, facilities should determine the feasibility of relying on these sources and plan accordingly.

Comment: Some commenters stated that alternate sources of energy to maintain temperatures for patient health and safety may not be realistic to achieve because their emergency systems may already have pre-planned areas of need, such as use in the emergency department, operating rooms, intensive care units, and necessary medical life sustaining needs, such as ventilators, oxygen and intravenous equipment, and cardiac monitoring equipment. In clinical care areas of facilities, patients may have to be moved, fans may have to be brought in or temperature control may be outside of the facility's control entirely. Temperatures to maintain safe and sanitary storage of provisions may not be viable due to limited backup power. Commenters recommended that these requirements be aligned with the current NFPA® standards. Commenters recommended that we require hospitals to describe in their emergency plans how they will mitigate specific scenarios, such as if they are unable to maintain temperatures or refrigeration. In addition, they review their current emergency power capacity and assess whether upgrades should be made. The commenters stated that CMS' proposed rule could be interpreted as increasing requirements on electrical systems and require upgrades to those systems, which could be costly to accomplish.

Response: We understand that protocols for emergency distribution of energy within a facility may have already been set to accommodate such priorities as emergency lighting, fire detection, alarm systems, and providing life-sustaining care and treatment. We agree with the commenters that facilities should include as part of their risk assessment how specific needs will be met to maintain temperatures to protect patient health and safety. We are not requiring facilities to upgrade their electrical systems, but after their review of their facility risk assessment, facilities may find it prudent to make any necessary adjustments to ensure that patients' health and safety needs are met and that facilities maintain safe and sanitary storage areas for provisions.

Comment: Many commenters expressed concern about their perception that they would be held responsible for maintaining sewage and waste disposal in their facility during and after an emergency event. The commenters thought that such matters were outside their scope of responsibilities. Some thought our expectations were unclear. Some commenters noted that energy is not always required for these processes. A commenter stated that in some emergencies, infrastructure could be damaged, backup power could be unavailable, local water and sewage services could be limited or unavailable, or their hazardous waste disposal contractors could be unavailable. Other commenters recommended that CMS require hospitals to have backup plans if their primary waste-handling operations become disabled or disrupted, which could include storing waste in a secure area until the facility arranged removal. The commenters also recommended that hospitals identify and assess the risks in their risk assessments relating to their facility's wastewater system and describe in their emergency plan how they would address specific scenarios in which sewage might become a problem. Several commenters stated that the treatment of sanitary sewage on site would possibly require the installation of an onsite sewage treatment plant if the municipal system were disrupted, which would be impossible for inner city facilities due to limited physical space. Commenters stated that the proposed rule seemed to require that waste continue to be disposed of in a disaster, and that the proposed rule was too broad.

Response: We agree with the commenters' recommendation that facilities should identify and assess their sewage and wastewater systems as part of their facility-based risk assessment and make necessary plans to maintain these services. We are not requiring onsite treatment of sewage but that facilities make provisions for maintaining necessary services.

Comment: A commenter stated that CMS should revise the requirement at § 482.15(b)(6) to state “use of health care volunteers” to clarify that this requirement is different from the requirement for the use of “general” volunteers.

Response: The intent of this requirement is to address any volunteers. We believe that in an emergency a facility or community would need to accept volunteer support from individuals with varying levels of skills and training and that policies and procedures should be in place to facility this support. Health care volunteers would be allowed to perform services within their scope of practice and training and non-medical volunteers would perform non-medical tasks. As such, we disagree with limiting this requirement to just medical volunteers.

After consideration of the comments we received on the proposed rule, we are finalizing our proposal with the following modifications:

• Revising § 482.15(b)(1)(i) to add that hospitals must have policies and procedures that address the need to stock pharmaceuticals during an emergency.
• Revising § 482.15(b)(2) to remove the requirement for hospitals to track staff and patients after an emergency and clarifying that in the event staff and patients are relocated, hospitals must document the specific name and location of the receiving facility or other location for sheltered patients and on-duty staff who leave the facility during the emergency.
• Revising § 482.15(b)(5) to change the phrase “ensures records are secure and readily available” to “secures and maintain availability of records.”
• Revising § 482.15(b)(5) and (7) to remove the word “ensure.”
• Adding a new § 482.15(f) to allow a separately certified hospital within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

3. Communication Plan (§ 482.15(c))

An effective and well maintained communication plan will facilitate coordinated patient care across healthcare providers, and with state and local public health departments and emergency systems to protect patient health and safety in the event of a disaster. For a hospital to operate effectively in an emergency situation, we proposed at § 482.15(c) that hospitals be required to develop and maintain an emergency preparedness communication plan that complies with both federal and state law. We proposed that hospitals be required to review and update the communication plan at least annually. During an emergency, it is critical that hospitals, and all providers/suppliers, have a system to contact appropriate staff, patients' treating physicians, and other necessary persons in a timely manner to ensure continuation of patient care functions throughout the hospital and to ensure that these functions are carried out in a safe and effective manner. Updating the plan annually would facilitate effective communication during an emergency. Providers and suppliers are to have contact information for federal, state, tribal, regional, or local emergency preparedness staff and other sources of assistance. Patient care must be well coordinated across healthcare providers, and with state and local public health departments and emergency systems to protect patient health and safety in the event of a disaster.

At § 482.15(c)(1), we proposed that the communication plan include names and contact information about staff, entities providing services under arrangement, patients' physicians, other hospitals, and volunteers. We stated that, during an emergency, it is critical that hospitals have a system to contact appropriate staff, patients' treating physicians, and other necessary persons in a timely manner to ensure continuation of patient care functions throughout the hospital and to ensure that these functions are carried out in a safe and effective manner. We proposed at § 482.15(c)(2) to require hospitals to have contact information for federal, state, tribal, regional, or local emergency preparedness staff and other sources of assistance.

We proposed at § 482.15(c)(3) to require that hospitals have primary and alternate means for communicating with the hospital's staff and federal, state, tribal, regional, or local emergency management agencies.

We also proposed at § 482.15(c)(4) to require that hospitals have a method for sharing information and medical documentation for patients under the hospital's care, as necessary, with other healthcare facilities to ensure continuity of care.

We proposed at § 482.15(c)(5) that hospitals have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510 of the HIPAA Privacy Rule. Thus, hospitals would need to have a communication system in place capable of generating timely, accurate information that could be disseminated, as permitted, to family members and others. We believe this requirement would best be applied only to facilities that provide continuous care to patients, as well as to those facilities that take responsibility for and have oversight over or both, care of patients who are homebound or receiving services at home.

We proposed at § 482.15(c)(6) to require hospitals to have a means of providing information about the general condition and location of patients under the facility's care, as permitted under 45 CFR 164.510(b)(4) of the HIPAA Privacy Rule. Section 164.510(b)(4), “Use and disclosures for disaster relief purposes,” establishes requirements for disclosing patient information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts for purposes of notifying family members, personal representatives, or certain others of the patient's location or general condition. We did not propose prescriptive requirements for how a hospital would comply with this requirement. Instead, we stated that we would allow hospitals the flexibility to develop and maintain their own system. Lastly, we proposed at § 482.15(c)(7) that a hospital have a means of providing information about the hospital's occupancy, needs, and its ability to provide assistance, to the authority having jurisdiction or the Incident Command Center, or designee.

Comment: Many commenters expressed support for the proposal to require hospitals to develop and maintain an emergency preparedness communication plan that complies with both federal and state law and is reviewed and updated annually. A commenter noted that the proposed requirements are consistent with TJC standards. The commenter noted that while they believe that these requirements can be met by larger institutions with ease, smaller institutions may have more difficulties.

A few commenters disagreed with the proposal to require that communications plans have contact information for all staff physicians, families, patients, and contractors. A commenter stated that this would require an additional full time equivalent (FTE) staff member. Another commenter stated that it would be challenging and overly burdensome to maintain a current contact list, especially for volunteers.

A commenter stated that it could be difficult for children's hospitals to maintain a comprehensive list of people and entities, as required for a hospital's communication plan. The commenter gave an example of a hospital that maintains a listing for most managers and above, but not for all general staff and volunteers.

Response: We appreciate the commenters' support and feedback. We disagree with the commenters who suggested that it would be overly burdensome for hospitals to maintain a current contact list. As a best practice, most hospitals maintain an up-to-date list of their current staff for staffing directories and human resource management. In addition, most hospitals have procedures or systems in place to handle their roster of volunteers. We believe that a hospital would have a comprehensive list of their staff, given that these lists are necessary to maintain operations and formulate a payroll. In addition, we continue to believe that it is critically important that hospitals have a way to contact appropriate physicians treating patients, and entities providing services under arrangement, other hospitals, and volunteers during an emergency or disaster event to ensure continuation of patient care functions throughout the hospital and to ensure continuity of care.

Furthermore, we clarify that we are not requiring hospitals to include in their communication plan contact information for the families of staff, or the families of patients who are not directly involved in the patient's care, or contractors not currently providing services under arrangement.

Comment: A commenter recommended that CMS scale back the requirement for an alternate means of communication, in order to allow facilities more time to evaluate existing communications technology and to gradually build toward a more integrated and collaborative system as resources allow.

Response: We do not believe that scaling back the requirements for an alternate means of communication to be used during an emergency would be beneficial to hospitals and their patients. As we have learned over the years, landline telephones are often inoperable for an extended period of time during and after disasters. Cell phones also can be unreliable and are often without reception during an emergency event, or are completely unusable due to a lack of cellular coverage in certain remote and rural areas. Therefore, it is appropriate and vitally important for hospitals to have some alternate means to communicate with their staff and federal, state and local emergency management agencies during an emergency. While we are not endorsing a specific alternate communication system or requiring the use of certain specific devices, we expect that facilities would consider using the following devices:

• Pagers.
• Internet provided by satellite or non-telephone cable systems.
• Cellular telephones (where appropriate). Facilities can also carry accounts with multiple cell phone carriers to mitigate communication failures during an emergency.
• Radio transceivers (walkie-talkies).
• Various other radio devices such as the NOAA Weather Radio and Amateur Radio Operators' (ham) systems.
• Satellite telephone communication system.

Comment: A few commenters expressed support for the proposed language that requires that the hospital's communication plan include a method for sharing information and medical documentation for patients under the hospital's care, as necessary, with other healthcare facilities to ensure continuity of care. The commenters noted that the proposed language is flexible and does not require the use of any specific technology. The commenters recommended that CMS continue to use flexible language in the final rule and not require hospitals to use any specific technology. The commenters noted that, in many instances, hospitals would share information through paper-based documentation.

Response: We appreciate the commenters' support. We reiterate that § 482.15(c)(4) requires that facilities have a method for sharing information and medical documentation for patients under the hospital's care, as necessary, with other healthcare facilities to ensure continuity of care. As the commenters pointed out, we are not requiring, nor are we endorsing, a specific digital storage or dissemination technology. Furthermore, we note that we are not requiring facilities to use EHRs or other methods of electronic storage and dissemination. In this regard, we acknowledge that many facilities are still using paper-based documentation. However, we encourage all facilities to investigate secure ways to store and disseminate medical documentation during an emergency to ensure continuity of care.

Comment: A few commenters objected to the requirement that hospitals have a method for sharing information and medical documentation for patients under the hospital's care. A commenter specifically objected to the sharing of medical records with other health systems. The commenter stated that it is difficult to share this information with facilities that have different systems. Another commenter stated that the expectation that hospitals will share clinical documentation is unrealistic. The commenter noted that many HHAs still operate with paper documentation, are stand-alone facilities, and do not coordinate with other healthcare systems or with other local facilities. The commenter stated that surveyors should be aware that the capability of facilities to communicate patient-specific clinical documentation to other facilities in the local healthcare system is likely to be limited.

Response: We disagree with the commenters' statement that hospitals should not or cannot have a method for sharing information and medical documentation for patients during an emergency or disaster, as necessary. We believe that hospitals should have an established system of communication that would ensure that patient care information could be disseminated to other providers and suppliers in a timely manner, as needed, during an emergency or disaster.

We have seen the importance of formulating this type of communication plan in the past to ensure continuity of care. Sharing patient information and documentation was found to be a significant problem during the 2005 hurricanes and flooding in the Gulf Coast states. In 2011, the ability to share information during the Joplin, Missouri tornado both electronically and via hard copy helped patient evacuations and continuity of care. In addition, during Hurricane Sandy in 2012, some hospitals reported receiving evacuated patients from a nearby hospital with little or no medical documentation (HHS OIG, Hospital Emergency Preparedness and Response During Super Storm Sandy. September 2014). In some cases, electronic medical records were unavailable and only oral patient histories could be provided. This lapse in medical documentation is detrimental to patient care. Therefore, we continue to believe that hospitals should include in their communication plan a method for sharing information and medical documentation for patients under the hospital's care, as necessary, with other healthcare providers to ensure continuity of care. We encourage hospitals and other providers and suppliers to engage in coalitions in their area for assistance in effectively meeting this requirement.

We clarify that we are not requiring the use of EHRs within this regulation and we understand that some hospitals and other providers and suppliers may still be using paper medical records. However, we encourage these facilities to consider the use of alternative means of storing patient care information, to ensure that medical documentation is preserved and easily disseminated during an emergency or disaster.

Comment: A commenter recommended that the requirements pertaining to a method or means of sharing information include timelines for submission of such documentation to other healthcare providers or other entities as described in proposed § 482.15(c)(4) through (6).

Response: We do not believe that it is appropriate to include suggested timelines for facilities to share information and medical documentation for patients under the hospital's care in these emergency preparedness requirements. Instead, we believe that the facility should determine the appropriate timeline for the dissemination of information to other providers and pertinent entities. We have included the language “as necessary” in the regulations to allow facilities flexibility to share information and medical documents as needed to ensure continuity of care for patients during an emergency.

Comment: A few commenters expressed concern about the language used in the preamble, which states that hospitals would share comprehensive patient care information. The commenters noted that the term “comprehensive information” is not defined and suggested that CMS focus on relevant information that enables a care provider to determine what medical services and treatments are appropriate for each patient.

Response: We agree with the commenters that facilities should share relevant patient information to ensure continuity of care for a patient in situations where a provider must evacuate. In addition, we note that while we did not propose to require that providers share comprehensive patient care information, we believe that relevant patient information includes, but is not limited to, the patient's presence or location in the hospital; personal information the hospital has collected on the patient for billing or demographic analysis purposes, such as name, age, address, and income; or information on the patient's medical condition. Although we have not specified requirements for timelines for delivering patient care information, we would expect that facilities would provide patient care information to receiving facilities during an evacuation, within a timeframe that allows for effective patient treatment and continuity of care.

Comment: A commenter requested clarification on the proposal that requires hospital communication plans to include a means, in the event of an evacuation, to release patient information as permitted under current law.

Response: In response to this public comment, we are clarifying that § 482.12 (c)(5) requires that the hospital must have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510(b)(1)(ii), which establishes permitted uses and disclosures of protected health information to notify a family member, a personal representative of the individual, or another person responsible for the individual's location, general condition, or death. We are also clarifying in parallel provisions of the regulation that RNHCIs, ASCs, hospices, PRTFs, PACE organizations, LTC facilities, ICF/IID facilities, CAHs, CMHCs, and dialysis facilities must have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510(b)(1)(ii).

Facilities should establish an effective communication system, in accordance with the previously referenced provision of the HIPAA Privacy Rule that could generate timely, accurate information that can be disseminated, as permitted, to family members and others. Facilities should also consider including in their communication plan information on what type of patient information is releasable and who is authorized to release this information during an emergency.

Comment: A commenter expressed concern over the financial burden that smaller institutions may incur when implementing a system for sharing information. The commenter noted that this burden may be reduced as more institutions move towards EHRs. Therefore, the commenter recommended a phased-in approach to implementing this requirement.

Response: We understand the commenter's concern about the potential financial burden that smaller facilities may incur. However, we have not specified a method or a system for sharing patient information. These regulations enable facilities to develop procedures that best meet their needs and take into account their facility's resources. Additionally, we believe that many facilities already have basic emergency preparedness plans, which may reduce the cost of implementation.

We encourage facilities to engage in healthcare coalitions in their area for assistance. We also refer facilities to the following Web sites for more information about emergency communication planning:

• http://transition.fcc.gov/pshs/emergency-information/guidelines/health-care.html
• http://www.dhs.gov/government-emergency-telecommunications-service-gets
• http://www.phe.gov/preparedness/planning/hpp/reports/documents/capabilities.pdf

Comment: Several commenters expressed concern about the proposed provisions that would require hospitals to include a means of providing information about the general condition and location of patients under the facility's care as permitted under 45 CFR 164.510(b)(4). Commenters noted that hospitals should already have HIPAA compliance plans in place that would address emergency situations. They also noted that some states have stricter privacy laws than HIPAA and, therefore, the commenters recommended that the regulatory language include a phrase that states that facilities should comply with applicable state privacy laws in addition to HIPAA.

A few commenters questioned if the HIPAA privacy laws would be relaxed or waived during an emergency. A commenter requested clarification on privacy rules in emergency situations across all providers and suppliers, first responders, and community aid organizations.

Response: Section 482.15(c) states that hospitals must develop and maintain an emergency preparedness communication plan that complies with both federal and state law. This phrase is applicable to the requirement that hospitals should provide a means of providing information about the general condition and location of patients under the facility's care; therefore, hospitals are required to comply with both 45 CFR 164.510(b)(4) and all pertinent state laws. Several commenters recommended that the regulatory language include a phrase that states that facilities should comply with applicable state privacy laws in addition to HIPAA. We note that the requirement as currently written will require hospitals to comply with all pertinent state laws, including pertinent state privacy laws, and that it is not necessary to add additional language.

HIPAA requirements are not suspended during a national or public health emergency. However, the HIPAA Privacy Rule specifically permits certain uses and disclosures of protected health information in emergency circumstances and for disaster relief purposes, as described in HHS guidance at http://www.hhs.gov/hipaa/for- professionals/special-topics/emergency-preparedness/index.html . In addition, under section 9 of the Project Bioshield Act of 2004 (Pub. L. 108-276), which added paragraph 1135(b)(7) to the Act, the Secretary of HHS may waive penalties and sanctions against facilities that do not comply with certain provisions of the HIPAA Privacy Rule if the President declares an emergency or a disaster and the Secretary declares a public health emergency.

Facilities and their legal counsel should review the HIPAA Privacy Rule carefully before deciding to share patient information. We refer readers to the following resources for more information on the application of the HIPAA Privacy Rule during an emergency:

• http://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/
• http://www.hhs.gov/sites/default/files/emergencysituations.pdf
• http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/index.html

Comment: A few commenters stated that the language set out in the proposed rule describing requirements for a hospital's communication plan would have broad implications for EHRs. The commenters noted that this regulation could result in facilities being deemed non-compliant for reasons outside of their control, since, as they argue, the industry does not have the ability to electronically transfer or share patient information and medical documentation in a disaster with other healthcare facilities in a HIPAA-compliant manner.

Response: We appreciate the commenters concerns regarding the difficulties that facilities could experience with their EHRs' operability with non-EHR healthcare facilities during an emergency. We acknowledge that EHR technology is in varying stages of development throughout the provider and supplier communities and understand the ramifications of this when patient information and necessary medical documentation needs to be communicated during an emergency.

If a facility using EHRs experiences an emergency where patient information needs to be communicated to a receiving facility that does not support an EHR system, alternate methods such as paper documentation or faxed information can be used. Facilities are encouraged to explore alternate means of communicating this information.

The rule requires a method of sharing patient information and medical documentation to ensure continuity of care as part of their communication plan. Interpretive guidance for this regulation and subsequent surveyor training will be completed after the publication of this rule.

Comment: A few commenters stated that Health Information Exchange (HIE) networks are in varying stages of development and, in some areas, no HIE network is available. Therefore, some of these commenters suggested that CMS work with the Office of the National Coordinator (ONC) to support policies that accelerate the development of a robust infrastructure for HIE networks.

Response: We appreciate this feedback and agree with the commenters. CMS continues to work with the ONC to support and promote the adoption of health information technology and the nationwide development of HIE to improve healthcare. While we are not mandating the use of EHRs through this rule, we encourage facilities to consider the meaningful use of certified EHR technology to improve patient care.

HHS has initiatives designed to encourage HIE among all healthcare providers, including those who are not eligible for the Electronic Health Record (EHR) Incentive Programs, and are designed to improve care delivery and coordination across the entire care continuum. Our revisions to this rule are intended to recognize the advent of electronic health information technology and to accommodate and support adoption of Office of the National Coordinator for Health Information Technology (ONC) certified health IT and interoperable standards. We believe that the use of such technology can effectively and efficiently help facilities and other providers improve internal care delivery practices, support the exchange of important information across care team members (including patients and caregivers) during transitions of care, and enable reporting of electronically specified clinical quality measures (eCQMs). For more information, we direct stakeholders to the ONC guidance for EHR technology developers serving providers ineligible for the Medicare and Medicaid EHR Incentive Programs titled “Certification Guidance for EHR Technology Developers Serving Health Care Providers Ineligible for Medicare and Medicaid EHR Incentive Payments.” ( http://www.healthit.gov/sites/default/files/generalcertexchangeguidance_final_9-9-13.pdf ).

In addition, we encourage facilities to engage in healthcare coalitions in their area in effort to identify local best practices and potential examples that may assist them in developing communication plans that include a procedure for sharing information and medical documentation, when necessary, with other healthcare facilities to ensure continuity of care.

Comment: A few commenters discussed the requirements for communication plans as set out in the most recent NFPA® 99-2012 guidelines. Citing the NFPA® 99-2012 requirements for communication plans, the commenters noted that CMS' proposed communication plan requirements are too general by comparison. The commenters stated that this generalization would make it harder to verify that a facility's plan meets the emergency preparedness requirements and would make the verification of adherence to these requirements tedious and subjective. Furthermore, the commenters stated that the proposal mimics the current standard in the NFPA® 99-2012, and may cause misinterpretation and conflict as the regulations change over time.

A commenter stated that some key communication planning items are not included in the proposed rule and are better described in the standard NFPA® 99, “Health Care Facilities Code, 2012 edition.”

Response: We appreciate the commenters' feedback about the NFPA® 99-2012 edition. We issued a final rule on May 4, 2016 entitled “Medicare and Medicaid Programs; Fire Safety Requirements for Certain Health Care Facilities” (81 FR 26871), to adopt the 2012 editions of NFPA® 101, “Life Safety Code,” and NFPA® 99, “Health Care Facilities Code.” We refer readers to that final rule for a discussion of these requirements.

We do not believe that we have been overly prescriptive in our communication plan requirements. Facilities are afforded the flexibility to include more detailed and stringent communication plan policies in their emergency preparedness plan, as long as they meet the minimum requirements described here.

Comment: A commenter recommended that CMS explicitly include social media in the communications plan requirements. The commenter noted that social media has recently proven to be an essential tool for communication during disasters.

Response: We appreciate the commenter's feedback. While we acknowledge the importance of other types of electronic communication and encourage facilities to utilize technology when developing a well-organized communication plan, which may include communication through social media, the regulations list the minimum requirements for a provider's communication plan. We have not prescribed specific communication plans within our regulations and have instead allowed hospitals the flexibility to formulate and maintain their own communication plans. We would expect facilities to choose appropriate ways to communicate with patients or the community as a whole.

Comment: A commenter recommended that CMS encourage the integration of the hospital in the community Joint Information Center, and focus on not only the logistics and infrastructure of communication, but the actual management of messages and act of communicating.

Response: We encourage hospitals to develop an effective communication plan that contains contact information for local emergency preparedness staff and to also have a primary and alternate means for communicating with local emergency management agencies. A hospital's communication plan, for example, may have specific protocols for communicating with a community emergency operations center or joint information center, and if the hospital so chooses, the plan can contain procedures on how to formulate, manage, and deliver messages. As previously stated, the hospital can exceed the minimum standards described here.

Comment: A few commenters requested clarification on the definition of the term “geographic area”, as used in the requirement for the backup of electronic information to be stored within and outside of the geographic area where the hospital is located.

Another commenter stated that it is unclear how a facility could demonstrate that any backup system would be sufficiently “geographically remote” from the region and stated that CMS should clearly define the expectations of this section. The commenter also noted that an expectation that facilities establish data farms in extremely remote areas of service was excluded from the ICR burden calculations.

The commenters also expressed concern about the language in the proposed rule which stated that “electronic information would be backed up both within and outside the geographic area where the hospital was located” and questioned what exactly constitutes enough of a geographic separation to meet the intent of the proposed language.

Response: We clarify that we are not requiring facilities to utilize EHRs or electronic systems that would require external backup, off-site storage facilities, or data farms. In meeting the requirement that a hospital have a method for sharing information and medical documentation for patients under the hospital's care, facilities may choose to store or back up electronic information within and outside the geographic area if they determine that this is the best option for their facility to maintain their ability to provide information that can ensure continuity of patient care during a disaster. Facilities may find this strategy useful during an emergency if the facility loses power or needs to be evacuated. However, although we believe that it is a best practice to have an alternate storage location for medical documentation, we are not mandating that facilities store information within and outside the geographic area where the hospital is located. We encourage facilities to consider all options that are available to them to protect their medical documentation to ensure continuity of care should an emergency or disaster occur.

Comment: A commenter recommended that CMS require facilities to address recovery of operations planning in emergency and communications plans.

Response: We agree that it is important for hospitals and other providers and suppliers to consider recovery of operations while planning for an emergency. However, we note that the scope and focus of the emergency preparedness requirements in this regulation are on continuity of operations during and immediately after an emergency. Hospitals and other providers and suppliers may choose, as a best practice, to incorporate recovery of operations in their emergency plans but we note that this is not a requirement that needs to be met in order to be in compliance with these conditions of participation. We refer readers to the resources noted in this final rule on recovery of operations.

Comment: A commenter noted that when large scale events occur, public communication systems are overburdened and ineffective. Furthermore, the commenter noted that although hospitals will have alternate means to communicate through technology such as HAM radio, 800 megahertz (MHz)/ultrahigh frequency (UHF) radio, satellite systems, and Government Emergency Telecommunications Service (GETS), these technologies will not be readily available to the persons that the hospital may be trying to reach. The commenter recommended that CMS focus on the hospital establishing processes to readily communicate with staff, care providers, suppliers, and family.

Response: We understand the commenter's concerns about failures in public communication systems and we agree that hospitals should include processes that would allow for communication with staff, care providers, families, and others who may not have alternative forms of technology such as HAM and satellite systems. However, hospitals should be as well prepared as possible ahead of an emergency or disaster as they attempt to mitigate any potential system failures. We believe that our proposal to require that hospitals develop and maintain a communication plan that includes a means for communicating with hospital staff, and with federal, state, tribal, regional, and local emergency management entities, appropriately helps to prepare hospitals to communicate with the appropriate emergency management officials during an emergency or disaster. We encourage hospitals to consider all types of alternate communication systems and to develop a communication plan that includes procedures on how these alternate communication plans are used, and who uses them. Hospitals may seek information on the National Communication System (NCS), which offers a wide range of National Security and Emergency Preparedness communications services, the Government Emergency Telecommunications Services (GETS), the Telecommunications Service Priority (TSP) Program, Wireless Priority Service (WPS), and Shared Resources (SHARES) High Frequency Radio Program at http://www.hhs.gov/ocio/ea/National%20Communication%20System/ (click on “services”).

Comment: A commenter stated that state, regional and local emergency operations have required the “Chain of Command” process. The commenter notes that facilities should have the flexibility to adhere to the state/regional Chain of Command and that clarification is needed to define the scope of the expectation of the proposed rule.

Response: As previously stated, § 482.15(c) states that hospitals must develop and maintain an emergency preparedness communication plan that complies with both federal and state law. We are not prescribing, nor are we mandating, that hospitals abide by a certain “Chain of Command” process. As long as hospitals are complying with federal and state law, hospitals are given the flexibility in these rules to comply with a “Chain of Command” process that is utilized at their state or local level. We do encourage hospitals to understand National Incident Management System (NIMS) which provides a common emergency response structure and suggested communications processes that will better support and enable integration with local, tribal, regional, state and federal response operations. We would also expect hospitals that choose to comply with a “Chain of Command” process would include such procedures in their communication plan.

Comment: A commenter recommended that CMS include language in § 482.15(c)(6) requiring the disclosure of patient information to state and local emergency management agencies.

Response: We believe that hospitals should have a means of providing information, as permitted under the HIPAA Privacy Rule, 45 CFR 164.510, in the event of an evacuation and that a hospital should have a means of providing information about the general condition and location of patients under the facility's care as permitted under 45 CFR 164.510(b)(4). However, we do not believe that it is appropriate to include in these regulations a mandatory requirement that hospitals specifically disclose patient information to state and local health department and emergency management agencies. Hospitals may release patient information during an evacuation or emergency disaster, in compliance with federal and state laws.

Comment: A commenter recommended that CMS include the phrase “and in accordance with state law” in § 482.15(c)(6).

Response: We disagree with the commenter that an additional phrase “and in accordance with state law” should be included in § 482.15(c)(6). We believe that language at § 482.15(c), which states that the hospital must develop and maintain an emergency preparedness communication plan that complies with both federal and state law, sufficiently addresses concerns about hospital compliance with state laws.

Comment: A commenter recommended that CMS consider including non-healthcare facilities in the communication plan, such as child care programs and schools, where children with disabilities and other access and functional needs may be sheltering in place.

Response: We do not believe that it is appropriate to require hospitals to include other providers of services, such as child care programs and schools, in their communication plan in these conditions of participation. However, we have allowed facilities the flexibility and the discretion to include such providers in their communication plans if deemed appropriate for that facility and patient population.

Comment: A commenter stated that communications planning should include equipment interoperability, redundancy, communications, and cyber security provisions. The commenter also stated that the primary and alternate communication systems for hospitals should include interoperability coordination, planning and testing with interdependent healthcare systems, their supporting critical infrastructure systems, and critical supply chains.

Response: We agree with the commenter that hospitals should consider security, equipment interoperability, and redundancy in their emergency preparedness plan. We also agree with the statement that hospitals should plan for and test interoperability of their communication systems during drills and exercises. However, we are allowing facilities flexibility in how they formulate and operationalize the requirements of the communication plan. We have not included specific requirements on cyber security and redundancy. However, we encourage facilities to assess whether their specific facility can benefit from such plans.

Comment: A few commenters requested that CMS provide clarification on which federal laws are referenced in the proposed rule in regards to the proposed communication plan. The commenters wanted to ensure that facilities are aware of, and comply with, all applicable federal regulations. A commenter expressed concern that, without knowing the federal statutes referenced it would be difficult for hospitals to assess whether compliance would be burdensome. A commenter stated that clarifying this statement would assist facilities to determine the real cost of compliance.

Response: As with all CoPs, we expect facilities to adhere to additional federal and state laws that are applicable and necessary to provide quality healthcare. For example, some states might have more stringent requirements for their healthcare facilities and personnel and we would expect the facilities to comply with those requirements. Our CoPs do not preclude facilities from establishing requirements that are more stringent.

We encourage facilities to determine what federal, state, and local laws apply to their specific facility's locations and develop plans that comply with these federal, state, and local emergency preparedness requirements.

Comment: A commenter stated that while most hospitals meet the requirements in the proposed communication plan, the onus should be with the state and not the hospital to determine authorized levels of interoperability with all healthcare partners.

Response: We understand the commenter's concerns about the potential burden on hospitals. However, we believe that hospitals have the ability to maintain an emergency preparedness communication plan while working in conjunction with the federal, state, tribal, regional or local emergency preparedness staff. We expect that hospitals will be able to communicate and coordinate with other healthcare facilities in order to protect patient health and safety during an emergency or disaster event. We continue to support hospitals and other facilities engaging in healthcare coalitions in their area for assistance broadening awareness and collaboration as well as in identifying best practices that can assist them to effectively meet this requirement.

Comment: A commenter stated that annual review requirements are a dated approach to ensuring that policies are kept up-to-date. The commenter recommended that CMS eliminate the annual review requirements and tie the review and revision to the testing process and periodic risk assessment.

Response: We disagree with the commenter's statement that annual review requirements are dated. We believe that hospitals are best prepared to act appropriately and swiftly during an emergency or disaster event with an updated communication plan. Updating the hospital's communication plan, at least annually will account for changes in staff that have occurred during the year at the hospital and at the federal, state, tribal, regional or local level. In addition, hospitals can update their communication plans at any time to incorporate the most recent best practices and lessons learned.

We note that this standard includes the minimum requirements for reviewing and updating a hospital's emergency preparedness communication plan. Hospitals can review and update their communication plan more frequently than annually if they choose to do so. Currently, many hospitals frequently update their contact list to account for staffing changes. Therefore, we continue to believe that hospitals should review and update their communication and emergency preparedness plan at least annually.

Comment: A commenter expressed support for the proposed communication plan for hospitals but stated that an annual update of staff contact information is not frequent enough. The commenter recommended that CMS modify this standard to require that staff information be maintained more often than annually, such as quarterly or semi-annually. The commenter notes that within 1 year, key staff and individual responsibilities that are needed during an emergency can change.

Another commenter recommended that facilities reevaluate and update their emergency and communication plan within 180 days of a specific emergency event.

Response: We thank the commenters for their suggestion. We agree that staff information at hospitals changes frequently and note that, as a best practice, hospitals may choose to consider updating their communication plan more frequently than annually. However, we are requiring that hospitals update their communication plan at least annually, which allows for hospitals to update their emergency contact list quarterly, semi-annually or more frequently if they choose to do so and still maintain compliance with the requirements of this standard. We encourage hospitals to assess whether it is appropriate to update their contact lists annually or more frequently than annually.

In regards to the recommendation that facilities reevaluate and update their emergency and communication plan within 180 days of a specific emergency event, we note that the emergency preparedness CoPs require that hospitals and other providers and suppliers review and update their plans at least annually at a minimum. We are also requiring, at § 482.15(d)(2)(iv), that hospitals analyze the hospital's response to, and maintain documentation of, all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan, as needed. Facilities can choose to review and update their plans more frequently than annually at their own discretion.

After consideration of the public comments we received, we are finalizing our proposal, with the following modifications:

• Revising § 482.15(c) by adding the term “local” to this and parallel provisions throughout the rule to clarify that hospitals must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 482.15(c)(4) by replacing the term “ensure” with “maintain.”
• Revising § 482.15(c)(5) to clarify that hospitals must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).

4. Training and Testing (§ 482.15(d))

We proposed at § 482.15(d) that a hospital develop and maintain an emergency preparedness training and testing program. We proposed to require the hospital to review and update the training and testing program at least annually.

We stated that a well-organized, effective training program must include providing initial training in emergency preparedness policies and procedures. We proposed at § 482.15(d)(1) that hospitals provide such training to all new and existing staff, including any individuals providing services under arrangement and volunteers, consistent with their expected roles, and maintain documentation of such training. In addition, we proposed that hospitals provide training on emergency procedures at least annually and ensure that staff demonstrate competency in these procedures.

Regarding testing, we proposed at § 482.15(d)(2), to require hospitals to conduct drills and exercises to test their emergency plans. We proposed at § 482.15(d)(2)(i) to require hospitals to participate in a community mock disaster drill at least annually. If a community mock disaster drill is not available, we proposed that hospitals should conduct individual, facility-based mock disaster drills at least annually. However, we proposed at § 482.15(d)(2)(ii) that if a hospital experiences an actual natural or man-made emergency that requires activation of the emergency plan, the hospital would be exempt from engaging in a community or individual, facility-based mock disaster drill for 1 year following the actual event.

We proposed at § 482.15(d)(2)(iii) to require hospitals to conduct a paper-based tabletop exercise at least annually. We indicated that the tabletop exercise could be based on the same or a different disaster scenario from the scenario used in the mock disaster drill or the actual emergency. We proposed to define a tabletop exercise as a group discussion led by a facilitator, using a narrated, clinically-relevant emergency scenario, and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan.

We proposed at § 482.15(d)(2)(iv) that hospitals analyze their response to, and maintain documentation on, all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan as needed.

We received many comments on our proposed changes to require a hospital to develop and maintain an emergency preparedness training and testing program.

Comment: In general, most commenters supported our proposal to require hospitals to develop an emergency preparedness training and testing program. We received a few general comments about the requirement. A commenter stated that training and testing would heighten provider awareness with regard to the facilities' limitations and ultimately ameliorate some of the negative effects of a disaster on continuity of care through quicker decision making. A few commenters expressed concerns about the financial burden that the development of training and testing programs would impose on their facilities. Some agreed that state and local governments may be able to provide training resources for some rural and smaller hospitals and facilities; however, some commenters pointed out that many states and local governments are facing considerable staffing and budget cuts, limiting their resources. In addition, a few commenters provided suggestions for how we could improve the discussion of our proposed requirement within the preamble section of the proposed rule.

Response: We thank the commenters for their support and feedback. We agree that overall emergency preparedness planning will have a positive impact on facilities, suppliers, and the populations that they serve. We recognize the time and financial impact that the development of training and testing programs will impose on facilities, but believe that the benefits of heightened awareness, improved processes, and increased safety and preparedness will ultimately outweigh the burden.

Comment: Many commenters expressed concerns about the varying levels of emergency preparedness experience of hospitals as well as other provider and supplier types. Commenters stated that some providers, hospitals in particular, may have a trained disaster response or planning person on staff. These commenters wanted to know how we will take this into consideration when surveying providers and suppliers on this training and testing requirement.

Response: We believe that this final rule establishes core components of an emergency preparedness program that align to national emergency preparedness standards and can be used not only for hospitals, but across provider and supplier types, while tailoring requirements for individual provider and supplier types to their specific needs and circumstances, as well as the needs of their patients, residents, clients, and participants. We proposed individual requirements for each provider and supplier type that will be surveyed at the individual facility level. As with the standard surveying process, each provider and supplier type will be individually surveyed for their specific training and testing requirements, rather than in comparison to the capabilities of other healthcare settings affected by this regulation. In addition, as discussed earlier, we are finalizing our proposal for an implementation date that is one-year after the effective date of this final rule. This implementation date will allow providers who may not be experienced in emergency preparedness planning, time to access resources and develop plans that best meet their needs. We are not requiring that any facility have a designated staff member responsible for emergency preparedness. However the facility may choose to establish such a position.

Comment: A few commenters recommended that we specifically require that the training and testing program be developed consistent with the principles of the Homeland Security Exercise and Evaluation Program (HSEEP). A commenter believed that our proposed requirement is not specific enough and should lay out exactly what our expectations are for a successful training program and what exactly is required. Another commenter pointed out that, while we referenced the principles of HSEEP in the preamble, we did not require such principles in our regulations. A commenter suggested that we require all healthcare facilities to receive training in an incident command system.

Response: We appreciate the recommendations. The requirements we establish are the minimum health and safety standards that facilities must meet; however, a provider or supplier may choose to set higher standards for its facility. In the proposed rule, we provided facilities with resources and examples to help them begin developing a training and testing program. We do not believe that we should limit the principles/guidelines that a facility may want to utilize when developing its program.

Comment: A commenter supported our proposal for the development of an emergency preparedness training program, but suggested that hospitals and all providers and suppliers include first responders in all aspects of their training program. The commenter stated that the inclusion of first responders would help to ensure consistency, allowing both groups to do their jobs in a more productive and safer manner, ultimately improving communications across the board in the event of an emergency.

Response: We agree that first responders are an essential part of the emergency management community and are relied upon heavily during a man-made or natural disaster. However, we do not have the statutory authority to regulate first responders and emergency management personnel. In an effort to bolster communication and collaboration, we proposed to require that providers and suppliers include in their emergency plan a process for ensuring cooperation and collaboration with local, tribal, regional, state, and federal health department and emergency preparedness officials' efforts. This would include documentation of efforts to contact such officials and, when applicable, their participation in collaborative and cooperative planning efforts. We also encourage providers and suppliers to engage and collaborate with their local healthcare coalition, which commonly includes the health department, emergency management, first responders, and other emergency preparedness professionals.

Comment: A commenter suggested that the requirement for a training and testing program specify that drills and exercises must address varying emergencies supporting the proposed all-hazards approach to planning. The commenter explained that this would include flooding in a portion of a building due to a water line rupture as well as flooding that requires evacuation of patients. Another commenter suggested that the training program should be competency-based. The commenter believed that competencies help connect training and testing, in essence providing a common denominator and language at the facility preparedness level. The commenters also stated that the disaster medicine and public health community has long recognized the importance of competencies, as evidenced by the multiple competency sets developed for disaster health.

Response: While not explicitly stated, we would assume that a hospital's training materials and testing exercises would be reflective of the risk assessment that is required as part of their emergency plan, utilizing an all-hazards approach. In order to accurately assess its plan, a hospital would need to have training and exercises that address realistic threats based on their risk assessment, otherwise the training and testing program would not be effective. The purpose of the training and testing program is to demonstrate the effectiveness of the hospital's emergency plan and to use the results of drills and exercises to improve the hospital's plan. We would also expect that a hospital would want to provide insightful and meaningful training, and would therefore tailor its training materials to the audience receiving the instruction. A hospital may always choose to establish internal facility policies that go beyond the minimum health and safety standards that we are finalizing.

Comment: A few commenters pointed out that many healthcare facilities are actively educating their staff on emergencies specific to their environments and conducting preparedness exercises. Some commenters suggested that annual training would only be appropriate for staff members who may take on positions in an emergency, but would be irrelevant to a large portion of the system's staff.

A few comments stated that our proposal for annual staff training is inappropriate, redundant in many situations, and a waste of scarce healthcare resources. Some commenters recommended that we only require annual training and exercises for those providers that would be instrumental in a disaster and require less frequent training and exercises for those providers that would not be expected to be operational during a disaster.

Response: As evidenced by every new disaster, and by the GAO and OIG reports that we discussed in the proposed rule (See 78 FR 79088), we believe that there is substantial evidence that provider and supplier staff need more training in emergency practices and procedures. Initial and annual staff training promotes consistent staff behavior and increases the knowledge of staff roles and responsibilities during a disaster. To offset some of the financial impact that training may impose on facilities, we have allowed facilities the flexibility to determine the level of training that any staff member may need. A provider could decide to base this determination on the staff member's involvement or expected role during a disaster. In addition, since staff members may be expected to act outside of their usual role during a disaster, providers could also decide to equally train staff on varying functions during a disaster. In this final rule we have revised our proposal to allow for large health systems to develop an integrated emergency preparedness program for all of their facilities, which would include an integrated training program. Therefore, to offset some of the financial burden, facilities that are part of a large health system may opt to participate in their health system's universal training program. However, the training at each separately certified facility must address the individual needs for such facility and maintain individual training records in order to demonstrate compliance.

Comment: A few commenters requested that we clarify what annual training would involve and define the minimum requirements of training needed to meet this annual training requirement.

Response: We are giving facilities the flexibility to determine the focus of their annual training. Because we are requiring that the emergency plan and policies and procedures be updated at least annually, staff would need to be trained on any updates to the emergency plan and policies and procedures. For instance, acceptable annual training could include training staff on new evacuation procedures that were identified in the facility's risk assessment and added to the emergency plan within the last year.

Comment: A commenter did not support our proposed requirement for annual training and stated that a demonstration of skill requires some method of physical validation. The commenter also stated that annual training would be overly burdensome for providers. Another commenter suggested that instead of requiring annual training, we should require annual validation of knowledge through written testing, demonstration, or real-world response based on plans and policies. A commenter expressed support for the intent of the annual training requirement, but encouraged CMS to provide more detail and information related to specific levels of training for individual healthcare workers within a provider or supplier organization. Also, some commenters requested clarification on how staff would demonstrate their knowledge of emergency preparedness.

Response: We thank the commenters for their feedback. We did not specify the content of a facility's annual training. The purpose of the requirement is to ensure that facilities are continually educating their staff on their emergency preparedness procedures and discussing how to implement such procedures during an emergency. We believe that it is up to a provider or supplier to determine what level of training is required of their staff based on their individual emergency plans and policies and procedures. We note that we also proposed to require at § 482.15(d)(1)(iv) that hospitals ensure that staff can demonstrate knowledge of their facility's emergency procedures. We believe that this requirement, in addition to the annual training requirement, requires facilities to ensure that staff is continuously being updated and educated on a facility's emergency procedures and encourages facilities to ensure that the annual trainings are informative and insightful, so that staff can demonstrate knowledge of the procedures. We would also expect that the results of the knowledge check should produce information that can be used to update the emergency plan and any future training.

Comment: Several commenters agreed that training of staff and volunteers is a significant aspect of emergency planning and pointed out that, in a disaster, many members of the hospital staff will continue to perform the same job they do every day. Commenters pointed out that most hospitals already provide basic awareness level training to staff as well as more comprehensive training for employees who are assigned a leadership or management role in the hospital's incident command system during an emergency.

Several commenters requested that we clarify who exactly we are referring to in paragraph § 482.15(d)(1)(i), which states that individuals providing services under arrangement must receive initial training in emergency preparedness policies and procedures. Several commenters requested that we provide examples to eliminate any confusion about the use of the phrase. Other commenters stated that they believed that CMS was referring to groups of physicians, other clinicians, and others who provide services essential for adequate care of patients and maintenance of operation of the facilities, but whose relationship with the hospital is by contract rather than through employment or voluntary status. The commenters pointed out that there may be others with whom a hospital would have an arrangement for the provision of services, but these may be services that would not be essential during the course of a disaster. For example, the commenters explained that hospitals often have arrangements for servicing of office equipment, provision of staff training and education, grounds keeping, and so forth. The commenters stated that they do not believe it was our intent for all personnel covered by these arrangements to be trained for emergency preparedness, but would appreciate some clarification.

Several commenters recommended that we allow hospitals the flexibility to identify outsourced services that would be essential during a disaster and allow the hospital to identify which of these contracted individuals should receive training. Furthermore, a commenter posed a set of specific scenarios for us to consider, including whether the employees of a contracted food service, or a contracted plumber or electrician would need to have emergency preparedness training before they are able to work in the hospital. Similarly, this commenter believed that the language, as proposed, needed to be clarified.

In addition, a commenter requested that we further define what we mean by “volunteers” who would need to be trained. The commenter stated that the term was vague and questioned whether every volunteer would need training, and if so, what level of training. The commenter also inquired about a requested time frame for volunteers to complete training and how often volunteers would be required to be retrained. The commenter pointed out that volunteers are under no obligation to report for duty and cannot be relied upon to perform specified responsibilities during a disaster.

Finally, a commenter requested that we include a definition of “staff” in our proposal to require staff training, since many inpatient hospital-based specialists, such as hospitalists or neonatologists, now provide much of the inpatient medical care. The commenter also suggested that we require hospitals to identify individuals on staff and under contract that would need basic training, as well as staff that would likely manage an emergency event. The commenter suggested that we require hospitals to have a documented training plan for individuals with key responsibilities. The commenter also stated that hospitals should not be required to train all staff, contractors, and volunteers given that the costs associated with such training would far exceed the benefit in times of scarce resources.

Response: We appreciate all of the detailed feedback that we received from commenters on this requirement. The term “staff” refers to all individuals that are employed directly by a facility. The phrase “individuals providing services under arrangement” means services furnished under arrangement that are subject to a written contract conforming with the requirements specified in section 1861(w) of the Act. According to our regulations, governing boards, or a legally responsible individual, ensures that a facility's policies and procedures are carried out in such a manner as to comply with applicable federal, state and local laws. We believe that anyone, including volunteers, providing services in a facility should be at least annually trained on the facility's emergency preparedness procedures. As past disasters have shown, emergency situations or disasters can be either expected or unexpected. Therefore, training should be made available to everyone associated with the facility, and it is up to the facility to determine the level to which any specific individual should be trained. One way this could be determined is by that individual's involvement or expected role during an emergency. We stated at § 482.15(d)(1)(i) that training should be provided consistent with facility staff's expected roles. To mitigate costs it may be beneficial for facilities to take this approach when establishing their training programs. In addition, as we state elsewhere in this preamble, we encourage facilities to participate in healthcare coalitions in their area. Depending on their duties during an emergency, a facility may determine that documented external training is sufficient to meet the facility's requirements.

Comment: Many commenters supported the requirement for participation in a community drill/exercise and stated that it would better prepare both facility staff and patients regarding procedures in an actual emergency. However, a few commenters requested clarification of the requirement. Specifically, some commenters requested that we clarify what we meant by “community,” while another commenter encouraged CMS to allow organizations to define their community as they saw fit rather than based on geographical locations. A commenter questioned if standard state-required emergency drills would meet the requirement of a community disaster drill. The commenter noted that in their state, all facilities are required to participate in a statewide tornado drill that evaluates the facility and staff on their ability to recognize the threat alert and respond to the alert in accordance with their emergency plan. Another commenter requested that we specify how intensive an exercise would need to be in order to meet the new requirements.

Response: We understand that many disasters, such as floods, can involve a wide geographic area. In addition, we also recognize that many hospitals and various providers operate as part of a large health system. However, we would still expect a hospital or other healthcare facility to consider its physical location and the individuals who reside in their area when conducting their community involved testing exercises. We did not define “community”, to afford providers the flexibility to develop disaster drills and exercises that are realistic and reflect their risk assessments. However, the term could mean entities within a state or multi-state region. The goal of the provision is to ensure that healthcare providers collaborate with other entities within a given community to promote an integrated response. In the proposed rule, we indicated that we expected hospitals and other providers to participate in healthcare coalitions in their area for additional assistance in effectively meeting this requirement. Conducting exercises at the healthcare coalition level could help to reduce the administrative burden on individual healthcare facilities and demonstrate the value of connecting into the broader medical response community, as well as the local health and emergency management agencies, during emergency preparedness planning and response activities. Conducting integrated planning with state and local entities could identify potential gaps in state and local capabilities that can then be addressed in advance of an emergency. Regional planning coalitions (multi-state coalitions) meet and carry out exercises on a regular basis to test protocols for state-to-state mutual aid. The members of the coalitions are often able to test incident command and control procedures and processes for sharing of assets that promote medical surge capacity.

Comment: Several commenters indicated that the term “mock” disaster drill is not a common term in emergency exercise vocabulary. Some recommended that we use the Homeland Security Exercise and Evaluation Program vocabulary, “disaster drill exercise.” Another commenter suggested that we use the preferred term of “functional” or “full-scale exercise.” Commenters believed that these terms are clearer in regard to the expectations for hospitals and other providers.

Response: We appreciate the suggestions and agree that the term could be revised to more appropriately reflect the intention of the requirement. In contrast to an instructor led tabletop exercise utilizing discussion, the requirement for participation in a community disaster drill exercise is meant to require facilities to simulate an anticipated response to an emergency involving their actual operations and the community. We are aware that there are several current terms used to describe types of exercises and understand how the use of the term “mock disaster drill” may leave room for confusion. However, we note that industry terms evolve and change, so there is a need to ensure that the terms in our regulations are broad and inclusive, with a “plain language” meaning to the extent possible. In this final rule, we are revising our proposal by replacing the term “community mock disaster drill” with “full-scale exercise.” We believe that this term is broad enough to encompass the suggested terms from commenters, as well as an accurate description of the intent behind the provision.

Comment: A few commenters requested further clarification as to when a facility-based disaster drill could replace a community disaster drill. Most of the commenters pointed out that smaller hospitals and those providers outside of the hospital may not have close ties to emergency responders or community agencies that organize drills. Another commenter wanted to know what requirements would be placed on state and local governments to include all provider types in their disaster drill planning.

Response: We would expect that a facility-based disaster drill would meet the requirement for a community disaster drill if a community disaster drill were not readily accessible. For example, a rural provider located in a remote location might have limited ability to participate in a community disaster drill and would conduct a facility-based drill in order to comply with this requirement. The intention of this requirement is to not only assess the feasibility of a provider's emergency plan through testing, but also to encourage providers to become engaged in their community and promote a more coordinated response. Therefore, smaller facilities without close ties to emergency responders and community agencies are encouraged to reach out and gain awareness of the emergency resources within their community. We note that CMS does not regulate state and local governments' disaster planning activities.

Comment: Most commenters supported our proposal to exempt providers from the community mock drill requirement if the facility had experienced a disaster in the past year. A few commenters requested clarification on what would be considered activation of a facility's plan. The commenter wondered if there would have to be involvement of local emergency management or whether the activation could be made by the facility itself.

Response: In the proposed rule we stated that for the purpose of the proposed regulation, “emergency” or “disaster” can be defined as an event affecting the overall target population or the community at large that precipitates the declaration of a state of emergency at a local, state, regional, or national level by an authorized public official such as a governor, the Secretary of HHS, or the President of the United States (see 78 FR 79084). In addition, as noted earlier in the general comments section of this final rule, an emergency event could also be an event that affects the facility internally as well as the overall target population or the community at large. While allowing for the exemption of the community disaster drill requirement when an actual emergency event is experienced, we also proposed to require that facilities maintain documentation of all exercises and emergency events. To that extent, upon survey, a facility would need to show that an emergency event had occurred and be able to demonstrate how its emergency plan was put into action as a result of the emergency event.

Comment: Many commenters requested clarification of our proposal to require one tabletop exercise annually. Commenters stated that we did not provide a clear expectation of what tabletop exercise would meet our requirements. Commenters also recommended that we note that tabletop exercises could be computer-simulated and that we should not limit the requirement to paper-based tabletop exercises. A commenter noted that we were silent regarding who could serve as a facilitator for the tabletop exercise and questioned if a facilitator could be a staff member.

Response: In the proposed rule, we indicated that we would define a tabletop exercise as a group discussion led by a facilitator, using a narrated, clinically-relevant emergency scenario, and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan. We believe that this would also include the use of computer-simulated exercises. We also suggested that providers and suppliers consider using, among other resources, the tabletop exercise toolkit developed by the New York City Department of Health and Mental Hygiene's Bureau of Communicable Diseases (September 2005, found at: http://www.nyc.gov/html/doh/downloads/pdf/bhpp/bhpp-train-hospital-toolkit-01.pdf or the RAND Corporation's 2006 tabletop exercise technical report ( http://www.rand.org/pubs/technical_reports/2006/RAND_TR319.pdf ) to help them comply with this requirement. We were purposely silent on who could facilitate a tabletop exercise and believe that decision should be left to the discretion of the facility.

Comment: A commenter suggested that we require the tabletop exercises to focus on decompression of existing staffed beds (that is, how to move less critically ill patients out of the facility), identification of alternate space within a facility or adjacent campus buildings, and sheltering in place. The commenter also pointed out that many accrediting organizations require medical surge exercises, which could be combined in a decompression/surge scenario to incorporate issues that could occur in a real life event and might be a better focus for facility exercises.

Response: We appreciate the commenter's suggestion. We understand that depending on varying factors, such as provider type, size of facility, complexity of offered services, and location, facilities will have differing risks and needs. Therefore, we believe that facilities should have the flexibility to determine the focus of their exercises based upon their individual risk assessment, emergency plan, and policies and procedures. We note that, without more information about the specific medical surge exercise, in order to assess compliance, facilities would need to be able to demonstrate to surveyors how the medical surge exercise appropriately tests the facility's emergency preparedness plan.

Comment: Multiple commenters expressed their concern regarding our intent to require both a community mock disaster drill and a tabletop exercise every year and questioned the need for both. We received conflicting comments about the accessibility and burden of participating in a community mock disaster drill. While a few commenters stated that a community mock drill would be burdensome and require significant planning and time, other commenters stated that most organizations have several opportunities to participate in some type of integrated preparedness training exercise within their community every year. We also received conflicting comments about the effectiveness of tabletop exercises. A few commenters stated that tabletop exercises do not adequately determine the functionality of an emergency plan and can reduce a facility's level of preparedness. Another commenter stated that tabletop exercises are an efficient way to test policies that are currently in the plan and ensure that staff is knowledgeable about current operating procedures. Another commenter stated that tabletop exercises add value, but that a full-scale disaster drill is considered a best practice. A commenter stated that the requirement for a tabletop exercise is impractical for smaller providers and suggested that we base the necessity of the requirement on facility size.

Many commenters stated that most accrediting organizations and emergency response organizations require that providers test their emergency plans at least twice annually through fully operational exercises; these organizations do not accept a tabletop exercise to satisfy this requirement. These commenters recommended that we require two disaster drills annually and eliminate the requirement for a tabletop exercise. Furthermore, the commenters recommended that one of the drills be a community drill. Commenters also suggested that we exempt those facilities that participate in two annual disaster drills from the tabletop exercise requirement. A commenter suggested that we require a community mock disaster drill 1 year and a tabletop exercise the next year, rather than both in the same year. A commenter stated that conducting a disaster drill would require a good amount of planning and interruption of clinical services, therefore reducing this requirement to every other year would reduce the burden on the facility. Another commenter requested that we allow providers the flexibility to determine the type of drill or exercise needed to test their plan in accordance with their internal policies and procedures.

Response: We continue to believe that both a disaster drill and a tabletop exercise are effective in emergency preparedness planning. We understand that while beneficial, drills and exercises have financial implications that can be burdensome for some provider and supplier types. Many commenters observed that most hospitals are currently conducting drills and exercises, so any additional financial impact would be minimal. Therefore, in this final rule we are revising our proposed provision at § 482.15(d)(2) to require facilities to conduct one full-scale exercise and an additional exercise of their choice, which could be a second full-scale exercise or a tabletop exercise. We note that the full-scale exercise must be community-based unless a community exercise is not available. Facilities may opt to conduct more exercises, as needed, to improve their emergency plans and prepare their staff and patients and are encouraged to include community-based partners in all of their additional exercises where appropriate. We believe that this revision will give facilities the ability to determine which exercise is most beneficial to them as they consider their specific needs.

Comment: A commenter suggested that CMS require providers of all types to participate at least once annually in instructional programs, presentations, or discussion forums delivered by state health departments.

Response: We do not believe that it is appropriate to compel providers to attend instructional programs, presentations, or discussion forums delivered by state health agencies. However, as noted in § 482.15, hospitals must comply with all applicable federal and state emergency preparedness requirements. Therefore, if a hospital is located in a state that mandates that hospitals participate in emergency preparedness instructional programs, the hospital must comply with that state's laws. In addition, if hospitals' management determines such programs to be beneficial to such hospitals in development or maintenance of their emergency preparedness plans, such hospitals have the discretion, under these requirements, to attend such programs as they see fit, or they can incorporate such requirements into their training programs. It is not a requirement of these CoPs that hospitals attend programs overseen by state health departments.

Comment: A commenter suggested that we require completion of after-action reports (AARs) and Improvement Plans (IP) following the completion of drills, exercises, and real events. The commenter also suggested that these documents be made available for surveyors. In addition, the commenter indicated that subsequent exercises and retesting should also be required to demonstrate that improvements were successfully made.

Response: We proposed to require at § 482.15(d)(2)(iv) that hospitals analyze their response to, and maintain documentation of, all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan, as needed. Demonstrating the thorough completion of an AAR or IP would meet this requirement; however, we are not requiring completion of specific reports, in order to give facilities some flexibility in this area. In addition, as an example, we provided a link to the CMS developed Health Care Provider AAR/IP template in the proposed rule, which is a voluntary and user-friendly tool for healthcare providers to use to document their performance during emergency planning exercises and real emergency events, to inform recommendations for improvements for future performance. We indicated that, while we do not mandate the use of this template, thorough completion of the template would comply with our requirements for provider exercise documentation. Lastly, we believe our proposed requirement at § 482.15(d)(2)(i) and (iii) that a disaster drill and a tabletop exercise be conducted annually addresses the commenter's concern about subsequent exercises and retesting since a facility can test any problems it identifies in an upcoming testing exercise.

Comment: We received a few comments on our proposed requirement for hospitals to analyze the hospital's response to, and maintain documentation for, all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan, as needed. A commenter questioned how long after a training the documentation of such training would need to be retained. Another commenter recommended that, if a hospital were to experience two or more actual emergencies and performs an after-action review of its emergency plan, it should be exempt from this requirement.

Response: We believe that this requirement is necessary to ensure that hospitals are benefiting from the lessons learned through testing their plans and revising them as necessary, based on these lessons. We believe that, if a hospital experiences an actual emergency and develops an after-action review, it would be practical for the hospital to use this as an opportunity to revise and update their plan accordingly. In addition, we would expect a facility to maintain training documentation to demonstrate that it has met the training requirements. We note that hospitals are required at § 482.15(d) to update and review their training and testing program at least annually.

In summary, after consideration of the public comments, we are finalizing our proposal for hospitals to develop and maintain an emergency preparedness training and testing program as proposed, with the following exceptions:

• Revising § 482.15(d) by adding that each hospital's training and testing program must be based on the hospital's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 482.15(d)(1)(iv) by replacing the phrase “Ensure that staff can demonstrate” with the phrase “Demonstrate staff knowledge.”
• Revising § 482.15(d)(2) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 482.15(d)(2) to allow a hospital to choose the type of exercise it will conduct to meet the second annual testing requirement.

5. Emergency Fuel and Generator Testing (§ 482.15(e))

We proposed at § 482.15(e)(1)(i) that hospitals store emergency fuel and associated equipment and systems as required by the 2000 edition of the Life Safety Code (LSC) (NFPA®101) of the NFPA®. We note that CMS recently issued a final rule on May 4, 2016 entitled “Medicare and Medicaid Programs; Fire Safety Requirements for Certain Health Care Facilities” (81 FR 26872), to adopt the NFPA® 2012 edition of the LSC and the “Health Care Facilities Code.” The current LSC states that a hospital's alternate source of power (for example, a generator), and all connected distribution systems and ancillary equipment, must be designed to ensure continuity of electrical power to designated areas and functions of a healthcare facility. Also, the LSC states that the rooms, shelters, or separate buildings housing the emergency power supply must be located to minimize the possible damage resulting from disasters such as storms, floods, earthquakes, tornadoes, hurricanes, vandalism, sabotage and other material and equipment failures.

In addition to the emergency power system inspection and testing requirements found in NFPA® 99, “Health Care Facilities Code,” NFPA® 101,“Life Safety Code,” and NFPA® 110, “Standard for Emergency and Standby Power Systems,” we proposed that hospitals test their emergency and stand-by-power systems for a minimum of 4 continuous hours every 12 months at 100 percent of the power load the hospital anticipates it will require during an emergency.

We also proposed emergency and standby power requirements for CAHs and LTC facilities. As such, we requested information on this proposal, in particular on how we might better estimate costs in light of the existing LSC requirements, as well as other state and federal requirements.

Comment: We received a large number of comments from individual hospitals as well as national and state organizations that expressed concern with the proposed requirement for hospitals, CAHs and LTC facilities to test their generators. The commenters recommended that we continue to refer to the current NFPA® standards for generator testing, along with manufacturers' recommendations. Many commenters stated that there was not enough empirical data to support the proposed additional testing requirements. They further stated that there is no evidence that additional annual testing would result in more reliable generators. A commenter stated that a survey of hospitals affected by Hurricane Sandy did not indicate that increased testing would prevent generator failure during an actual disaster (Flannery, Johnathan, ASHE Advocacy Report 2013, pages 34-37) (“ASHE Report”). Other commenters stated that hospitals already test generators monthly as well as a 4 hour test every 3 years and, in their opinion, this testing schedule is sufficient. Some commenters stated that mandating additional testing would further burden already strained budgets because many healthcare facilities have more than one generator. They stated that the additional testing would cause unnecessary wear and tear on the equipment. Also, complying with the requirement for additional testing in certain geographical locations, such as California, could increase air pollution and the potential for some facilities to be fined by the EPA for emitting additional carcinogens in the air. Another commenter raised concerns that this increase in operational time may require additional guidance or permit validation from the Environmental Protection Agency (EPA) due to the increase in emissions.

Response: We appreciate the commenters concerns on this issue. As we discussed in the proposed rule, the purpose of the proposed change in the testing requirement was to minimize the issue of inoperative equipment in the event of a major disaster, as occurred with Hurricane Sandy. The September 2014 report of the Office of Inspector General (OIG) entitled, “Hospital Emergency Preparedness and Response During Hurricane Sandy” (OIG, OEI-06-13-00260, September 2014) stated that 89 percent of hospitals reported experiencing critical challenges during Sandy, “such as electrical and communication failures, to community collaboration issues over resources, such as fuel, transportation, hospital beds, and public shelters.” According to a survey conducted by The American Society for Healthcare Engineering (ASHE) of its member facilities affected by Hurricane Sandy (ASHE Report pages 34-37), 35 percent of the survey respondents reported that they were without power for a period of time that ranged from 30 minutes to over 150 hours. However, ASHE's survey concluded that there is no indication that equipment failure could have been anticipated by increasing the frequency of generator testing.

We also appreciate the commenters that pointed out the logistical and budgetary challenges for the healthcare facilities that would be affected by this rule. After carefully considering all of the comments we received and reviewing reports on Hurricane Sandy and Hurricane Katrina (Live Science, “Why power is So Tricky for Hospital During Hurricanes”, Rachael Rettner, November 1, 2012 see http://www.livescience.com/24489-hospital-power-outages-hurricane-sandy.html ), we believe that there are not sufficient data to assume that additional testing would ensure that generators would withstand all disasters, regardless of the amount of testing conducted prior to an actual disaster. Therefore, we have decided against finalizing the proposed requirement for additional generator testing at this time. We would expect facilities that have generators to continue to test their equipment based on NFPA® codes in current general use (2012 NFPA® 99, 2010 NFPA® 110 and 2012 NFPA® 101) and manufacturer requirements. Accordingly, we have revised § 482.15(e)(1) and (2) by removing the additional testing requirements and adding a new paragraph (h) which incorporates by reference the 2012 version the NFPA® 99, 2010 NFPA® 110 and 2012 NFPA® 101. As discussed in this final rule, we are also removing the additional generator testing requirements for CAHs and LTC facilities.

Comment: Several commenters stated that CMS standards regarding the location and maintenance of generators should be aligned as much as possible with existing standards, laws and regulations, to avoid conflict and confusion; and that the standards should be evaluated and updated periodically to reflect new knowledge and advances in technology. Many commenters agree with the proposed rule that would require a hospital's generator to be located in accordance with the requirements found in NFPA® 99, NFPA® 101, and NFPA® 110. Furthermore, they commented that CMS should be aligned with NFPA® in how it implements these standards. They stated that requirements already exist through NFPA® and local building codes, and that facilities currently comply with all applicable requirements. They also stated that the requirement for all emergency generators to be located in an area that is free from possible flooding should only apply to new installations, construction or renovation of existing structures. While no empirical data were provided, commenters claimed that relocation of existing equipment and systems would be cost-prohibitive.

Response: We appreciate the support of the commenters that agreed with the proposed requirement that generators be located in accordance with the requirements found in NFPA® 99, NFPA® 101, and NFPA® 110. These codes require hospitals that build new structures, renovate existing structures, or install new generators to place backup generators in a location that would be free from possible flooding and destruction. As such, the CMS requirements are aligned with the Life Safety Code (NFPA® 101), (which has been generally incorporated into CMS regulations) which cross-references 2012 NFPA® 99 and NFPA® 110, at § 482.15.

Comment: A few commenters recommended that CMS consider bringing any additional generator requirement to the NFPA® Technical Committees that maintain standards for emergency and stand-by power.

Response: The NFPA® is a private, nonprofit organization dedicated to reducing loss of life due to fire and other disasters. We have incorporated some of NFPA's codes, by reference, in our regulations. The statutory basis for incorporating NFPA's Codes for our providers and suppliers is the Secretary's general authority to stipulate such additional regulations for each type of Medicare and Medicaid participating facility as may be necessary to protect the health and safety of patients. In addition, CMS has discretionary authority to develop and set forth health and safety regulations that govern providers and suppliers that participate in the Medicare and Medicaid programs.

Comment: A few commenters stated that facilities should be required to have a backup plan that addresses the loss of power in a way that would allow them to continue operations without outside electricity. The commenter stated that this could be addressed a number of ways, including by diverting patients to a nearby facility within a reasonable commuting distance that has sufficient power for the facility to treat patients.

Response: We agree with the commenters. We would encourage facilities to develop an emergency plan that explores the best case scenarios to ensure optimum protection for patients and residents during an emergency. There are times when we would expect a facility to shelter in place and other times when it might be more feasible to evacuate. However, a hospital, or other inpatient provider, is likely to have inpatients at the beginning of a disaster, even when evacuation is planned. Therefore, the facility must be able to provide continued operations until all its patients have been evacuated and its operations cease.

Comment: A few commenters stated that alternate sources of energy to meet all regulatory requirements are currently available through emergency generators. They stated that it is neither practical nor prudent to require an emergency generator at all healthcare facilities, some of which simply close or relocate during a power loss.

Response: We proposed that the requirements for an emergency generator and onsite fuel source to power the emergency generator would apply only to hospitals, CAHs and LTC facilities. We did not include other providers/suppliers discussed in the proposed rule.

Comment: Several commenters opposed requiring facilities that maintain an onsite fuel supply to maintain a quantity of fuel capable of sustaining emergency power for the duration of the emergency or until likely resupply. The commenter pointed out that this approach does not consider the situation in which a hospital or LTC facility would evacuate or close during a prolonged emergency. A few commenters questioned how long a hospital should provide or maintain alternate sources of energy. Another commenter stated that what a facility anticipates it will need during “an emergency” does not necessarily match its in‐house generator's capacity. A facility gap analysis would define anticipated need per planned for emergency, and a facility's in‐house unit may be ample for some scenarios and not for others. A gap analysis may identify times when evacuation is recommended versus other scenarios when in-house capacity is ample to sustain operations.

Response: We appreciate all of the comments on this proposal. We realize that it would be difficult, if not impractical in certain circumstances, for a facility to have a fuel supply that would be sufficient for the duration of all disasters because the magnitude of the disaster might require facilities to evacuate patients/residents. After a careful evaluation of the comments, we have changed the final rule to require a hospital, CAH, or LTC facility to have a plan for how it will keep emergency power systems operational during the emergency, unless it evacuates.

After consideration of the comments we received on the proposed rule, we are finalizing our proposal with the following modifications:

• Revising § 482.15(e)(2)(i) by removing the requirement for an additional 4 hours of generator testing and clarifying that facilities must meet the requirements of NFPA® 99 2012 edition, NFPA® 101 2012 edition, and NFPA® 110 2010 edition.
• Revising § 482.15(e)(3) by removing the requirement that hospitals maintain fuel onsite and clarifying that hospitals must have a plan to maintain operations unless the hospital evacuates.
• Adding a new § 482.15(h) to incorporate by reference the requirements of NFPA® 99, NFPA® 101, and NFPA® 110.

D. Emergency Preparedness Regulations for Religious Nonmedical Health Care Institutions (RNHCIs) (§ 403.748)

Section 1861(ss)(1) of the Act defines the term “Religious Nonmedical Health Care Institution” (RNHCI) and lists the requirements that a RNHCI must meet to be eligible for Medicare participation.

We have implemented these provisions in 42 CFR part 403, subpart G, “Religious Nonmedical Health Care Institutions Benefits, Conditions of Participation, and Payment.” As of June 2016, there were 18 Medicare-certified RNHCIs that were subject to the RNHCI regulations.

A RNHCI is a facility that is operated under all applicable federal, state, and local laws and regulations, which provides only non-medical items and services on a 24-hour basis to beneficiaries who choose to rely solely upon a religious method of healing and for whom the acceptance of medical services would be inconsistent with their religious beliefs. The religious non-medical care or religious method of healing means care provided under established religious tenets that prohibit conventional or unconventional medical care for the treatment of the patient and exclusive reliance on religious activity to fulfill a patient's total healthcare needs.

The RNHCI does not furnish medical items and services (including any medical screening, examination, diagnosis, prognosis, treatment, or the administration of drugs or biologicals) to its patients. RNHCIs must not be owned by, or under common ownership or affiliated with, a provider of medical treatment or services.

We proposed to expand the current emergency preparedness requirements for RNHCIs, which are located within § 403.742, Condition of participation: Physical Environment, by requiring RNHCIs to meet the same proposed emergency preparedness requirements as we proposed for hospitals, subject to several exceptions.

The existing “Physical environment” CoP at § 403.742(a)(1) currently requires that the RNHCI provide emergency power for emergency lights, for fire detection and alarm systems, and for fire extinguishing systems. Existing § 403.742(a)(4) requires that the RNHCI have a written disaster plan that addresses loss of water, sewage, power and other emergencies. Existing § 403.742(a)(5) requires that a RNHCI have facilities for emergency gas and water supply. We proposed relocating the pertinent portions of the existing requirements at § 403.742(a)(1), (4), and (5) at proposed § 403.748(a) and (b)(1).

Proposed § 403.748(a)(1) would require RNHCIs to consider loss of power, water, sewage and waste disposal in their risk analysis. The proposed policies and procedures at § 403.748(b)(1) would require that RNHCIs provide for subsistence needs of staff and patients, whether they evacuate or shelter in place, including, but not limited to, food, water, sewage and waste disposal, non-medical supplies, alternate sources of energy for the provision of electrical power, the maintenance of temperatures to protect patient health and safety and for the safe and sanitary storage of such provisions, gas, emergency lights, and fire detection, extinguishing, and alarm systems.

The proposed hospital requirement at § 482.15(a)(1) would be modified for RNHCIs. We proposed at § 403.748(a)(1) to require RNHCIs to consider loss of power, water, sewage and waste disposal in their risk analysis. At § 403.748(b)(1)(i) for RNHCIs, we proposed to remove the terms “medical and nonmedical” to reflect typical RNHCI practice, since RNHCIs do not provide most medical supplies. At § 482.15(b)(3), we proposed that hospitals have policies and procedures for the safe evacuation from the hospital, which would include consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance. At § 403.748(b)(3), we proposed to incorporate this hospital requirement for RNHCIs but to remove the words “and treatment” to more accurately reflect that medical care is not provided in a RNHCI.

We proposed at § 403.748(b)(5) to remove the term “health” from the proposed hospital requirement for “health care documentation” to reflect the non-medical care provided by RNHCIs.

The proposed hospital requirements at § 482.15(b)(6) would require hospitals to have policies and procedures to address the use of volunteers in an emergency or other staffing strategies, including the process and role for integration of state or federally designated healthcare professionals to address surge needs during an emergency. For RNHCIs, we proposed at § 403.748(b)(6) to use the hospital provision, but remove the language, “including the process and role for integration of state or federally designated healthcare professionals” since it is not within the religious framework of RNHCIs to integrate care issues for their patients with healthcare professionals outside of the RNHCI industry.

The proposed hospital requirements at § 482.15(b)(7) would require that hospitals develop arrangements with other hospitals and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to hospital patients. For RNHCIs, at § 403.748(b)(7), we added the term “non-medical” to accommodate the uniqueness of the RNHCI non-medical care.

The proposed hospital requirement at § 482.15(c)(1) would require hospitals to include in their communication plan: Names and contact information for staff, entities providing services under agreement, patients' physicians, other hospitals, and volunteers. For RNHCIs, we proposed substituting “next of kin, guardian or custodian” for “patients' physicians” because RNHCI patients do not have physicians.

Finally, unlike the proposed regulations for hospitals at § 482.15(c)(4), we proposed at § 403.748(c)(4), we propose to require RNHCIs to have a method for sharing information and care documentation for patients under the RNHCIs' care, as necessary, with healthcare providers to ensure continuity of care, based on the written election statement made by the patient or his or her legal representative. Also, at proposed § 403.748(c)(4), we removed the term “other” and “health” from the requirement for sharing information with “other health care providers” to more accurately reflect the care provided by RNHCIs.

At § 482.15(d)(2), “Testing,” we proposed that hospitals would be required to conduct drills and exercises to test their emergency plan. Because RNHCIs have such a narrow role and provide such a unique service in the community, we believe RNHCIs would not participate in performing such drills. We proposed that RNHCIs be required only to conduct a tabletop exercise annually. Likewise, unlike our proposal for hospitals at § 482.15(d)(2)(i), we did not propose that the RNHCI conduct a community mock disaster drill at least annually or conduct an individual, facility-based mock disaster drill. Although we proposed for hospitals at § 482.15(d)(2)(ii) that, if the hospital experiences an actual natural or man-made emergency, the hospital would be exempt from engaging in a community or individual, facility-based mock disaster drill for 1 year following the onset of the actual event, we did not propose this for RNHCIs.

At § 482.15(d)(2)(iv), we proposed to require hospitals to maintain documentation of all drills, tabletop exercises, and emergency events, and revise the hospital's emergency plan, as needed. Again, at § 403.748(d)(2)(ii), for RNHCIs, we proposed to remove reference to drills.

Currently, at § 403.724(a), we require that an election be made by the Medicare beneficiary or his or her legal representative and that the election be documented in a written statement that the beneficiary: (1) Is conscientiously opposed to accepting non-excepted medical treatment; (2) believes that non-excepted medical treatment is inconsistent with his or her sincere religious beliefs; (3) understands that acceptance of non-excepted medical treatment constitutes revocation of the election and possible limitation of receipt of further services in a RNHCI; (4) knows that he or she may revoke the election by submitting a written statement to CMS, and (5) knows that the election will not prevent or delay access to medical services available under Medicare Part A in facilities other than RNHCIs. Thus, at § 403.748(c)(4), we proposed that such election documentation be shared with other care providers to preserve continuity of care during a disaster or emergency.

We did not receive any comments that specifically addressed the proposed rule as it related to RNHCIs. However, after consideration of the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for RNHCIs with the following modifications in response to general comments made with respect to all facilities:

• Revising the introductory text of § 403.748 by adding the term “local” to clarify that RNHCIs must also comply with local emergency preparedness requirements.
• Revising § 403.748(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 403.748(b)(2) to remove the requirement for RNHCIs to track staff and patients after an emergency and clarifying that in the event that staff and patients are relocated during an emergency, the RNHCI must document the specific name and location of the receiving facility or other location for sheltered patients and on-duty staff who leave the facility during an emergency.
• Revising § 403.748(b)(5)(iii) and (b)(7) to remove the term “ensure.”
• Revising § 403.748(c) by adding the term “local” to clarify that the RNHCI must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 403.748(c)(5) to clarify that RNHCIs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 403.748(d) by adding that each RNHCI's training and testing program must be based on the RNHCI's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 403.748(d)(1)(iv) by replacing the phrase “ensure that staff can demonstrate” with the phrase “demonstrate staff.”

E. Emergency Preparedness Regulations for Ambulatory Surgical Centers (ASCs) (§ 416.54)

Section 1833(i)(1)(A) of the Act authorizes the Secretary to specify those surgical procedures that can be performed safely in an ASC. The surgical services performed in ASCs are scheduled, elective, procedures for non-life-threatening conditions that can be safely performed in a Medicare-certified ASC setting.

Section 416.2 defines an ambulatory surgical center (ASC) as any distinct entity that operates exclusively for the purpose of providing surgical services to patients not requiring hospitalization, and in which the expected duration of services would not exceed 24 hours following an admission.

As of June 2016 there were 5,485 Medicare certified ASCs in the U.S. The ASC Conditions for Coverage (CfCs) at 42 CFR part 416, subpart C, are the health and safety standards a facility must meet to obtain Medicare certification. Existing § 416.41(c) requires ASCs to have a disaster preparedness plan. This existing requirement states the ASC must: (1) Have a written disaster plan that provides for the emergency care of its patients, staff and others in the facility; (2) coordinate the plan with state and local authorities; and (3) conduct drills at least annually, complete a written evaluation of each drill, and promptly implement any correction to the plan. Since the proposed requirements are similar to and would be redundant with existing rules, we proposed to remove existing § 416.41(c). Existing § 416.41(c)(1) would be incorporated into proposed § 416.54(a), (a)(1), (2), and (4). Existing § 416.41(c)(2) would be incorporated into proposed § 416.54(a)(4) and (c)(2). Existing § 416.41(c)(3) would be incorporated into proposed § 416.54(d)(2)(i) and (iv).

We proposed to require ASCs to meet most of the same proposed emergency preparedness requirements as those we proposed for hospitals, with two exceptions. At § 416.54(c)(7), we proposed that ASCs be required to have policies and procedures that include a means of providing information about the ASCs' needs and their ability to provide assistance (such as physical space and medical supplies) to the authority having jurisdiction (local, state agencies) or the Incident Command Center, or designee. However, we did not propose that these facilities provide information regarding their occupancy, as we proposed for hospitals, since the term “occupancy” usually refers to occupancy in an inpatient facility. Additionally, we did not propose that these facilities provide for subsistence needs of their patients and staff.

Comment: Many commenters commended CMS' efforts to ensure that providers are prepared for emergencies. However, these commenters disagreed with CMS' proposed emergency preparedness requirements for ASCs. The commenters stated that the proposed requirements are too burdensome and that the current ASC disaster preparedness requirements in § 416.41(c) allow providers the appropriate amount of flexibility during an emergency. The commenters stated that ASCs should not be subjected to the same emergency preparedness requirements as hospitals. Most of these commenters requested that CMS revise the proposed emergency preparedness requirements for ASC. Some of these commenters recommended that CMS not finalize any of the proposed emergency preparedness requirements for ASCs.

Response: We understand the commenter's concerns and we agree with some of the comments that suggested that the emergency preparedness requirements for ASC should be modified, and we discuss these modifications in this rule. However, we disagree with the commenter's statement that emergency preparedness requirements for ASCs are burdensome and inflexible. We continue to believe that ASCs should develop an emergency preparedness plan that is based on a facility-based and community-based risk assessment utilizing an all-hazards approach. We believe that the emergency preparedness requirements finalized in this rule provide ASCs and other providers with the flexibility to develop a plan that is tailored to the specific needs of an individual ASC. There are several key differences between the requirements for ASCs and hospitals, including but not limited to subsistence needs requirements and the requirements to implement an emergency and standby power system. We have taken into consideration the unique characteristics of an ASC and have finalized flexible and appropriate emergency preparedness requirements for ASCs.

Comment: Several commenters agreed with exempting ASCs from the requirements to provide occupancy information and subsistence needs for staff and patients. The commenters noted that these requirements would be inappropriate for the ASC setting since many patients may visit an ASC once or twice during an episode of care. However, the commenters noted that other emergency preparedness requirements are inappropriate for the ASC setting. The commenters expressed concern about the requirement that ASCs must develop an emergency preparedness plan that includes a process for ensuring cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness official's efforts to ensure an integrated response during a disaster or emergency situation. The commenters noted that in many instances, communities do not include ASCs in their emergency preparedness efforts. They recommended that CMS explicitly state that an ASC is in compliance with all community-based requirements, as long as the ASC has written documentation of its attempts to cooperate and collaborate with community organizations, even if the community organizations never respond.

Response: We appreciate the commenter's support. Based on responses from several commenters, we are changing the wording of § 416.54(a) for this final rule to state that ASCs must include a process for maintaining cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials' efforts to ensure an integrated response during a disaster or emergency situation. We expect that ASCs will document their efforts to contact pertinent emergency preparedness officials and, when applicable, document their participation in any collaborative and cooperative planning efforts. We understand that providers cannot control the actions of other entities within their community and we are not expecting providers to hold others accountable for their participation or lack of participation in community emergency preparedness efforts. However, providers do have control over their own efforts and can develop a plan to cooperate and collaborate with members of the emergency preparedness community. We continue to believe that communication and cooperation with pertinent emergency preparedness officials is an important part of a coordinated and timely response to an emergency.

Comment: Several commenters expressed concern about the proposal to require that ASCs develop arrangements with other ASCs and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to ASC patients. The commenters noted that many ASCs offer specific, specialized elective procedures and non-emergency services and that the staff that work in an ASC do not have experience with trauma surgery and triaging. They also noted that, in case of an emergency, ASCs would cancel upcoming procedures, stabilize patients already in the facility, transfer patients who require a higher level of care, account for all ASC staff and volunteers, and either shelter in place current staff and volunteers or send them home. The commenters requested that CMS not finalize this proposal.

Response: We agree with the commenters. We understand that most ASCs are highly specialized facilities that would not necessarily transfer patients to other ASCs during an emergency and, based on this understanding of the nature of ASCs, we believe that ASCs should not be required to establish arrangements with other ASCs to transfer and receive patients during an emergency. Therefore, we are not finalizing the proposed requirement at § 416.54(b)(6). During an emergency, if a patient requires care that is beyond the capabilities of the ASC, we would expect that ASCs would transfer patients to a hospital with which the ASC has a written transfer agreement, as required by existing § 416.41(b), or to the local hospital, that meets the requirements of § 416.41(b)(2), where the ASC physicians have admitting privileges. ASCs should also consider in, their risk assessment, alternative hospitals outside of the area to transfer patients to, if the hospital with which the ASC has a written transfer agreement or admitting privileges is also affected by the emergency.

Comment: A commenter stated that the proposed rule was unclear about what is expected of ASCs in regards to requirements for alternate sources of energy to maintain temperature, emergency lighting, and fire detection, extinguishing and alarm systems.

Response: We did not propose specific temperature, emergency lighting, fire detection, extinguishing and alarm systems, or emergency and standby power requirements for ASCs. However, ASCs would be expected to follow all pertinent federal, state, and local law requirements outside of these regulations.

Comment: A commenter was concerned that ASCs would be required to comply with the Emergency Preparedness Checklist: Recommended Tool for Effective Health Care Facility Planning, before the final emergency preparedness regulations are published. The commenter suggested that the current survey process could be used to collect statistically significant data regarding the application of the final rule.

Response: The emergency preparedness checklist that the commenter refers to is a recommended checklist for emergency preparedness only. We are not requiring ASCs or other providers to comply with the recommendations in this checklist. However, ASCs must comply with the emergency preparedness requirements finalized in this rule 1 year after the final rule is published, as discussed in section II.B. of this final rule.

Comment: We proposed to require ASCs to track their patients and staff before and during an emergency. Most commenters questioned why some of the outpatient suppliers, such as CORFs and Organizations, were being treated differently and not required to track their patients and staff during an emergency when their services were vital to their patient populations. Commenters indicated that similar to these facilities, ASCs also have the flexibility to cancel appointments and close in the event of an emergency. Commenters requested that we remove this requirement.

Response: We proposed this requirement for ASCs because we believed an ASC should maintain responsibility for their staff and patients, if staff and patients were in the facility during the event of an emergency. For reasons discussed earlier, we have removed “after the emergency” from the regulations text for ASCs. We agree that if an emergency were to arise, ASCs would have the flexibility to cancel appointments and close. However, we also believe that emergencies may arise while staff and patients are in the ASC. Therefore, we do not believe the requirement should be removed. Instead, we are revising the regulations text further to require that if any staff or patients are in the ASC during an emergency and transferred elsewhere for continued or additional care, the ASC must document the specific name and location of the receiving facility or other location for those patients and on-duty staff who are relocated during and emergency. We note that if the ASC is able to close or cancel appointments, there would be no need to track patients or staff.

Comment: Several commenters expressed concern about whether the communication requirement could be interpreted to require the use of EHRs in ASCs. They noted that ASCs have not been included in recent federal programs that foster the use of healthcare information technology. A commenter noted that almost no ASCs are equipped with an interoperable EHR system that could communicate with other providers and suppliers.

Response: As finalized, § 416.54(c)(4) requires that facilities have a method for sharing information and medical documentation for patients under the ASC's care, as necessary, with other healthcare facilities to ensure continuity of care. We are not requiring, nor are we endorsing, a specific digital storage device or technology for sharing information and medical documentation. Furthermore, we are not requiring facilities to use EHRs or other methods of electronic storage and dissemination. In this regard, we acknowledge that some facilities are still using paper based documentation. However, we encourage all facilities to investigate effective ways to secure, store, and disseminate medical documentation, as permitted by the HIPAA Privacy Rule, to ensure continuity of care during an emergency or a disaster.

Comment: A few commenters stated that the proposed communication plan requirements would unnecessarily overburden ASCs. A commenter indicated specific concerns about ASCs maintaining contact information for other ASCs and stated that since ASCs are not 24-hour care facilities and because a transfer to another facility would likely be the result of a patient needing a high level of care, it is not reasonable for an ASC to have the contact information for other ASCs in their communication plan. Furthermore, the commenter noted that it is unreasonable for ASCs to have contact information for a list of emergency volunteers.

Other commenters stated that it would be reasonable for an ASC to develop a communication plan that would require ASCs to maintain contact information for those who work at their facilities and for community emergency preparedness staff.

Response: We disagree with the commenter's suggestion that ASCs would not be able to develop a communication plan that would include policies to maintain the contact information of the appropriate facility and emergency preparedness staff. ASCs are one of the few provider and supplier types that already have CfCs for emergency and disaster preparedness. They are currently required to maintain a written disaster preparedness plan that provides for care of patients and staff during an emergency and to coordinate the plan with state and local authorities, as appropriate. Therefore, we would expect that these ASC facilities would already have contact information for emergency management authorities and appropriate staff. We believe that, in light of these existing requirements, it is feasible for an ASC to continue to maintain these requirements and include written documentation for a communication plan.

However, we do agree with the commenters that it may be unreasonable for an ASC to maintain the contact information for other ASCs, given the highly specialized nature of care in most ASC facilities. The procedures performed in an ASC vary depending on the focus of the ASC. Some ASCs specialize solely in eye procedures, while other may specialize in orthopedics, plastic surgery, pain treatment, dental, podiatric, urological, etc. Therefore, we are not finalizing our proposal to require that ASCs maintain the names and contact information for other ASCs in the ASC's communication plan.

Comment: Several commenters addressed the proposal that would require ASCs to release patient information as permitted under 45 CFR 164.510 of the HIPAA Privacy Rule and to have a communication system in place capable of generating timely, accurate information that could be disseminated, as permitted, to family members and others. The commenters stated that this proposal is inappropriate for the ASC setting. The commenters noted that ASCs should be exempt from this requirement, since ASCs do not provide continuous care to patients nor to patients who are homebound or receiving services at home.

Response: We disagree with the commenters' statement that ASCs should be exempt from the proposed requirement at § 416.54(c)(6) that ASCs establish in their communication plan a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510. While it is true that ASCs do not provide continuous care to patients, we believe it is still of utmost importance for ASCs to be prepared to disseminate information about a patient's status, should an unforeseen emergency occur while the ASC is open and in operation. We believe that ASCs are fully capable of establishing an effective communication plan that would allow for the release of patient information in the event of an evacuation. Also, we believe that ASCs should be prepared to disseminate information on patients under the ASC's' care to family members during an emergency, as permitted under 45 CFR 164.510(b)(1)(ii). Therefore, it is important that ASCs have a plan in advance of this type of situation that would entail how the ASC would coordinate this effort to provide patient information. For example, if a patient is undergoing a procedure in an ASC and, due to an unforeseen natural disaster, the ASC is forced to evacuate or shelter in place, the ASC should have a system in place should they need to use or disclose protected health information to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for the care of the patient of the patient's location, general health condition, or death. We believe patients would be ill-served, and ASCs would be unprepared, if such a situation were to occur without a communication plan that establishes means, in the event of an evacuation, to release patient information. We note that the requirements of this final rule allow ASCs flexibility to construct a communication plan that best serves the facility's and their patients' individual circumstances.

Comment: We received several comments from the ASC community that opposed our proposal to require ASCs to participate in a community mock disaster drill at least once a year. The majority of the commenters noted that ASCs are not included in emergency preparedness efforts of their community. A commenter specifically noted that many communities do not include ASCs in their emergency preparedness efforts because they are primarily outpatient facilities that provide elective surgery, and are not designed to accommodate an influx of patients in case of an emergency. Another commenter noted that the proposed rule does allow for ASCs to conduct a facility-based disaster drill if a community drill is not available; however they stated that a drill of any kind would likely impose an additional burden on an ASC due to limited staff. A commenter suggested that ASCs be allowed to conduct a facility-based disaster drill if a community drill is not available or if the ASC is not part of a community's emergency preparedness efforts.

Response: We recognize the existence of a lack of community collaboration in some areas as it relates to emergency preparedness, which is one of the reasons we are seeking to establish unified emergency preparedness standards for all Medicare and Medicaid providers and suppliers. As noted earlier, we stated in the proposed rule that if a community disaster drill is not available, we would require an ASC to conduct an individual facility-based disaster drill. We also note that for the second annual testing requirement we are revising our testing standards to allow either a community disaster drill or a tabletop exercise annually, so an ASC may opt to conduct a tabletop exercise over a facility-based drill.

After consideration of the comments we received on the proposed emergency preparedness requirements for ASCs and the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for ASCs with the following modifications:

• Revising the introductory text of § 416.54 by adding the term “local” to clarify that ASCs must also comply with local emergency preparedness requirements.
• Revising § 416.54(a)(4) to delete the term “ensuring” and to replace the term “ensure” with “maintain.”
• Revising § 416.54(b)(1) to remove the requirement for ASCs to track all staff and patients after an emergency and requiring that if any on-duty staff or patients are in the ASC during an emergency and transferred or relocated, the ASC must document the specific name and location of the receiving facility or other location.
• Revising § 416.54(b)(4)(iii) by replacing the phrase “ensures records are secure” with the phrase “secures and maintains the availability of records.”
• Removing § 416.54(b)(6) that requires that ASCs develop arrangements with other ASCs and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to ASC patients, and renumbering paragraph (b)(7) as paragraph (b)(6).
• Revising § 416.54(c) by adding the term “local” to clarify that the ASC must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 416.54(c)(1)(iv) to remove the requirement that ASCs include the names and contact information for “Other ASCs” in the communication plan.
• Revising § 416.54(c)(5) to clarify that ASCs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 416.54(d) by adding that each ASC's training and testing program must be based on the ASC's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 416.54(d)(1)(iv) by replacing the phrase “ensure that staff can” with the phrase “demonstrate staff.”
• Revising § 416.54(d)(2)(i) by removing the requirement for ASCs to participate in a community-based disaster drill.
• Revising § 416.54(d)(2) to allow an ASC to choose the type of exercise they will conduct to meet the second annual testing requirement.
• Adding § 416.54(e) to allow a separately certified ASC within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

F. Emergency Preparedness Regulations for Hospices (§ 418.113)

Section 122 of the Tax Equity and Fiscal Responsibility Act of 1982 (TEFRA), Public Law 97-248, added section 1861(dd) to the Act to provide coverage for hospice care to terminally ill Medicare beneficiaries who elect to receive care from a Medicare-participating hospice. Under the authority of section 1861(dd) of the Act, the Secretary has established the CoPs that a hospice must meet in order to participate in Medicare and Medicaid The CoPs found at part 418, subparts C and D, apply to a hospice, as well as to the services furnished to each patient under hospice care.

Hospices provide palliative care rather than traditional medical care and curative treatment to terminally ill patients. Palliative care improves the quality of life of patients and their families facing the problems associated with terminal illness through the prevention and relief of suffering by means of early identification, assessment, and treatment of pain and other issues.

As of June 2016, there were 412 inpatient hospice facilities nationally. Under the existing hospice CoPs, hospice inpatient facilities are required to have a written disaster preparedness plan that is periodically rehearsed with hospice employees, with procedures to be followed in the event of an internal or external disaster and procedures for the care of casualties (patients and staff) arising from such disasters. This requirement, which is limited in scope, is found at § 418.110(c)(1)(ii) under “Standard: Physical environment.”

For hospices, we proposed to retain existing regulations at § 418.110(c)(1)(i), which state that a hospice must address real or potential threats to the health and safety of the patients, other persons, and property. However, we proposed to incorporate the existing requirements at § 418.110(c)(1)(ii) into proposed § 418.113(a)(2) and (d)(1). We proposed to require at § 418.113(a)(2) that the hospice's emergency preparedness plan include contingencies for managing the consequences of power failures, natural disasters, and other emergencies that would affect the hospice's ability to provide care. In addition, we proposed to require at § 418.113(d)(1)(iv) that the hospice periodically review and rehearse its emergency preparedness plan with hospice employees with special emphasis placed on carrying out the procedures necessary to protect patients and others. We proposed that § 418.110(c)(1)(ii) and the designation for paragraph (i) of § 418.110(c)(1) be removed. Otherwise, the proposed emergency preparedness requirements for hospice providers were very similar to those for hospitals.

In the proposed rule, we stated that despite the key differences between hospitals and hospices, we believed the hospital emergency preparedness requirements, with some reorganization and revision are appropriate for hospice providers. Thus, our discussion focused on the requirements as they differed from the requirements for hospitals within the context of the hospice setting. Since hospices serve patients in both the community and within various types of facilities, we proposed to organize the requirements for the hospice provider's policies and procedures differently from the proposed policies and procedures for hospitals. Specifically, we proposed to group requirements that apply to all hospice providers at § 418.113(b)(1) through (5) followed by requirements at § 418.113(b)(6) that apply only to hospice inpatient care facilities.

Unlike our proposed hospital policies and procedures, we proposed at § 418.113(b)(2) to require all hospices, regardless of whether they operate their own inpatient facilities, to have policies and procedures to inform state and local officials about hospice patients in need of evacuation from their respective residences at any time due to an emergency situation based on the patient's medical and psychiatric condition and home environment. Such policies and procedures must be in accord with the HIPAA Privacy Rule, as appropriate. This proposed requirement recognized that many frail hospice patients may be unable to evacuate from their homes without assistance during an emergency. This additional proposed requirement recognized the responsibility of the hospice to support the safety of its patients that reside in the community.

We note that the proposed requirements for communication at § 418.113(c) were the same as for hospitals, with the exception of proposed § 418.113(c)(7). At § 418.113(c)(7), for hospice facilities, we proposed to limit to inpatients the requirement that the hospice have policies and procedures that would include a means of providing information about the hospice's occupancy and needs, and its ability to provide assistance, to the authority having jurisdiction or the Incident Command Center, or designee. The proposed requirements for training and testing at § 418.113(d) were the same as those proposed for hospitals.

Comment: A commenter stated that it was unreasonable for home based hospices to be aligned with or have similar emergency preparedness requirements as hospitals. Another commenter requested that we exempt inpatient hospice facilities from meeting the same emergency standards as hospitals.

Response: We understand that residential facilities function much differently than hospitals; however we do not believe that we solely aligned the hospice requirements with hospitals. As stated in the proposed rule, we proposed to develop core components of emergency preparedness that could be used across provider and supplier types, while tailoring requirements for individual provider and supplier types to their specific needs and circumstances, as well as the needs of their patients. Specifically for hospice providers, we believe that we gave much consideration to whether the hospice was home based or an inpatient hospice. For example, we organized the hospice policies and procedures requirements based on those that apply to all hospice providers and those that apply to only hospice inpatient care facilities. Given the terminally ill status of hospice patients, we continue to believe that in an emergency situation they may be as or more vulnerable than their hospital counterparts. This could be due to the inherent severity of the hospice patient's illness or to the probability that the hospice patient's caregiver may not have the level of professional expertise, supplies, or equipment of the hospital-based clinician. We continue to believe that the hospital emergency requirement, with some reorganization and revision as proposed, is appropriate for all hospice providers. In addition, we note that existing hospice regulations at § 418.110(c)(1) already require inpatient hospice facilities to have a written disaster preparedness plan. Therefore, we do not agree that an exemption for inpatient or outpatient hospice facilities is appropriate.

Comment: A commenter noted that inpatient hospice facilities are often small in size and free-standing rather than integrated into larger healthcare facilities. The commenter requested that we provide flexibility in our requirements based on the size of a facility. In addition, the commenter indicated that smaller inpatient hospices do not have institutional kitchens and often contract for the provision of food. The commenter questioned whether it is acceptable to provide readymade meals for patients and staff for sheltering in place and for what period of time will hospices be expected to prepare to provide subsistence needs.

Response: We appreciate the commenter's feedback. Where feasible, we did not propose overly prescriptive requirements for any of the providers and suppliers, regardless of size. We note that we are only requiring facilities to have policies and procedures to address the provision of subsistence in the event of an emergency. This could include establishing a relationship with a non-profit that provides meals during disasters. All hospices have the flexibility to determine and manage the types, amounts, and needed preparation for providing subsistence needs based on their own facility risk assessments. We believe that allowing each individual hospice the flexibility to identify the subsistence needs that would be required during an emergency is the most effective way to address subsistence needs without imposing undue burden.

Comment: A commenter recommended that the executive team of each individual hospice should determine which staff should participate in the creation of their emergency preparedness plans, process, and tools.

Response: We thank the commenter for their suggestion. We did not indicate who must develop the emergency preparedness plans. All providers and suppliers have the flexibility to determine the appropriate staff that should be involved in the development of their entire emergency preparedness program.

Comment: A commenter supported our requirement for hospices to develop procedures to inform State and local officials about hospice patients in need of evacuation from their residences due to an emergency situation. However, the commenter indicated that for smaller hospice providers, developing and maintaining a current list of patients in need of evacuation assistance, along with the type of assistance required, will be a time-consuming manual effort. The commenter requested that we provide as much flexibility to this requirement as possible.

Response: We appreciate the commenter's support and feedback. We disagree with the statement that it would be overly burdensome for hospices to maintain a current list of patients and their needs of assistance. We also note that we did not limit the way in which hospices have to collect, maintain, or share this information. As a best practice, most hospices, regardless of size, maintain an up-to-date list of their current patients for organizational purposes and to maintain operations. In addition, we believe that it is current practice for staff to make daily assessments of the needs and capabilities of their hospice patients. We would also assume that the smaller the hospice, the smaller the number of patients they would need to assess and document. We continue to believe that it is critically important that hospices have a way to share this information with State and local officials.

Comment: Specific to hospices, commenters were unclear about what it would mean for a hospice to track patients from setting to setting during an emergency. For those home-based hospices, commenters noted that unlike an institutional setting, hospice patients reside in the community and their private residence with access to travel freely. Commenters supported the intent of the requirement, but requested that CMS revise this requirement taking into consideration the complexity of tracking patients receiving home-based care.

Response: We understand that we were not clear in our proposal about our intentions as to how hospice providers could meet this requirement. In addition, after reviewing the issues raised by commenters, we agree that further consideration should be given to variations between inpatient hospices and home based hospices. We agree that this factor, whether the hospice is inpatient or home based, creates a difference in the hospice provider's ability to track patients. Therefore, we are removing the requirement for home based hospices to track their staff and patients. Similar to the revisions we made for HHA, we are replacing the tracking requirement with a requirement for home based hospices to have policies and procedures that address the follow up procedures the hospice will exercise in the event that their services are interrupted during or due to an emergency event. In addition, the hospice must inform state and local officials of any on-duty staff or patients that they are unable to contact. Similar to the revisions we made for hospitals, we are keeping the requirement for inpatient hospices to track staff and patients during an emergency, but removing the language “after the emergency” from the regulation text. Instead we are revising the text to clarify that in the event that on-duty staff or patients are relocated during an emergency, the inpatient hospice must document the specific name and location of the receiving facility or other location for on-duty staff and patients who leave the facility during the emergency (that is, another facility, alternate sheltering location, etc.). We expect that for administrative purposes, all hospices already have some mechanism in place to keep track of patients and staff contact information. In addition, we expect that as a best practice, all hospices will find it necessary to communicate and follow up with their patients during or after an interruption in their services to close the loop on what services are needed and can still be provided. All hospices will have the flexibility to determine how best to develop these procedures, whether they utilize an electronic communication or some other method. We expect that the information would be readily available, accurate, and shareable among officials within and across the emergency response system, as needed, in the interest of the patient.

Comment: A hospice provider agreed with the need for a communication plan to be included in the emergency plan, but was unsure whether this should be addressed in a separate regulation specifically addressing communication. Another commenter supported the proposed communication plan requirements for hospices and HHAs, and noted the importance of communicating information to relevant authorities and facilities about the location and condition of vulnerable individuals, who may have difficulty evacuating during a disaster or emergency due to the severity of their illness.

Response: We appreciate the commenters' support and we agree with the commenters' point about the importance of communicating patient information, especially for vulnerable populations. We believe that it is important that hospice providers include in their emergency preparedness plans a communication plan that is reviewed and updated annually. We believe that requirements for a hospice's communication plan should be included in these emergency preparedness regulations, since we believe that an emergency preparedness plan for facilities is not complete without plans for communicating during an emergency or disaster.

Comment: A few hospice providers expressed concern about the proposed communication plan for hospices with respect to federal and state funding and support.

A commenter stated that most hospices do not have access to funding to purchase communication networks that link to first responders, hospitals, and county/regional Incident Command Centers. They stated that, aside from land lines and cell phones if they are available, communication could be very challenging, if not impossible. Another commenter stated that it would take more time, and more federal and state support, for hospice providers to meet the proposed requirements.

Response: We thank the commenters for their feedback. We understand the commenters' concerns about means of communication for hospice providers and refer readers to various communication planning resources, including http://www.hhs.gov/ocio/ea/National%20Communication%20System/ (The National Communication System) and those resources referenced in the proposed rule and this final rule.

We expect facilities to develop and maintain policies and procedures for patient care and their overall operations. The emergency preparedness requirement may increase costs in the short term because resources would have to be devoted to the assessment and development of an emergency plan that utilizes an all-hazards approach. While the proposed requirements could result in some immediate costs to a provider or supplier, we believe that developing an emergency preparedness program would be beneficial overall to any provider or supplier. In addition, we believe that planning for the protection and care of patients, clients, residents, and staff during an emergency or a disaster is a good business practice.

Comment: A few commenters expressed their concern about our proposal to require hospices to participate in both a community mock disaster drill and a paper based tabletop exercise. Mainly, the commenters acknowledged the benefits and necessity of participating in drills and exercises to determine the effectiveness of an emergency plan, but stated that conducting drills and exercises in the hospice setting is time consuming and would disrupt and compromise patient care.

Response: We agree that patient care is always the priority; however we believe that requiring staff to participate in training once a year is reasonable. Since the training will be anticipated, we believe that it would be possible for staff to work with their patients to adjust their schedules accordingly in order to participate in any such training. Emergency preparedness testing and training could be consolidated with other hospice training to reduce the impact and address staffing limitations. In addition, we believe that our decision to change our proposal to allow for either a community disaster drill or a tabletop exercise annually for the second annual testing requirement will provide hospices with the flexibility to determine which testing drill or exercise would be most beneficial to their organization, taking into consideration factors such as staff limitations and financial cost.

After consideration of the comments we received on the proposed emergency preparedness requirements for hospices, and the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for hospices with the following modifications:

• Revising the introductory text of § 418.113 by adding the term “local” to clarify that hospices must also coordinate with local emergency preparedness requirements.
• Revising § 418.113(a)(4) to delete the term “ensuring” and to replace the term “ensure” with “maintain.”
• Revising § 418.113(b)(1) to remove the requirement for home-based hospices to track staff and patients.
• Revising 418.113(b)(1) to clarify that in the event that there is an interruption in services during or due to an emergency, home based hospices must have policies in place for following up with on-duty staff and patients to determine services that are still needed. In addition, they must inform State and local officials of any on-duty staff or patients that they are unable to contact.
• Revising § 418.113(b)(5) to delete the term “ensure” and to replace it with the term “maintain.”
• Revising § 418.113(b)(6)(iii)(A) by adding that hospices must have policies and procedures that address the need to sustain pharmaceuticals during an emergency.
• Revising § 418.113(b)(6) by adding a new paragraph (v) to require that inpatient hospices track on-duty staff and patients during an emergency, and, in the event staff or patients are relocated, inpatient hospices must document the specific name and location of the receiving facility or other location to which on-duty staff and patients were relocated to during the emergency.
• Revising § 418.113(c) by adding the term “local” to clarify that the hospice must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 418.113(c)(5) to clarify that hospices must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 418.113(d) by adding that each hospice's training and testing program must be based on the hospice's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 418.113(d)(1)(ii) to replace the phrase “Ensure that hospice employees can demonstrate” to “Demonstrate staff.”
• Revising § 418.113(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 418.113(d)(2) to allow a hospice to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 418.113(e) to allow separately certified hospices within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

G. Emergency Preparedness Regulations for Psychiatric Residential Treatment Facilities (PRTFs) (§ 441.184)

Sections 1905(a)(16) and (h) of the Act define the term “Psychiatric Residential Treatment Facility” (PRTF) and list the requirements that a PRTF must meet to be eligible for Medicaid participation. To qualify for Medicaid participation, a PRTF must be certified and comply with conditions of payment and CoPs, at §§ 441.150 through 441.182 and §§ 483.350 through 483.376 respectively. As of June 2016, there were 377 PRTFs.

A PRTF provides inpatient psychiatric services for patients under age 21. Under Medicaid, these services must be provided under the direction of a physician. Inpatient psychiatric services must involve active treatment which means implementation of a professionally developed and supervised individual plan of care. The patient's plan of care includes an integrated program of therapies, activities, and experiences designed to meet individual treatment objectives that have been developed by a team of professionals along with the patient, his or her parents, legal guardians, or others into whose care the patient will be released after discharge. The plan must also include post-discharge plans and coordination with community resources to ensure continued services for the patient, his or her family, school, and community.

The current PRTF requirements do not include any requirements for emergency preparedness. We proposed to require that PRTF facilities meet the same requirements we proposed for hospitals. Because these facilities vary widely in size, we would expect that their emergency preparedness risk assessments, emergency plans, policies and procedures, communication plan, and training and testing will vary widely as well. However, we believe PRTFs have the capability to comply fully with emergency preparedness requirements so that the health and safety of its patients are protected in the event of an emergency situation or disaster.

Comment: A commenter questioned if a generator would be required to be used as an alternate source of energy.

Response: Emergency and standby power systems are not a requirement for PRTFs. That requirement applies only to hospitals, CAHs and LTC facilities. Alternate sources of energy could include, for example, propane, gas, and water-generated systems, in addition to other resources.

Comment: A commenter stated that it would be difficult for PRTFs, ICFs/IIDs, and CMHCs to implement a method to share patient information and medical documentation with other healthcare facilities to ensure continuity of care, since these entities are not uniformly using electronic health records. Therefore, the commenter recommended flexibility in the implementation of these requirements.

The commenter also noted that the CMS proposed rule stated that PRTFs are not likely to have formal communication plans. However, the commenter stated that PRTFs accredited by TJC are subject to Standard EM.02.02.01, which requires that the organization include in an emergency preparedness plan details on how the facility will communicate during emergencies.

Response: We believe that we have allowed for flexibility in how PRTFs develop and maintain their communication plans. However, if the commenter is referring to flexibility in when these requirements will be implemented, we refer the commenter to the section of this final rule that implements an effective date that is 1 year after the effective date of this final rule for these emergency preparedness requirements for all providers and suppliers.

In addition, we acknowledge that some PRTFs may already have communication plans in place, as required as a condition of TJC accreditation. We appreciate the commenter's feedback and note that facilities that meet TJC accreditation standards should be well-equipped to comply with the communication plan requirements established in these CoPs.

Comment: In response to our proposed requirement for a PRTF to participate in a community disaster drill, we received one comment which stated that PRTFs are often not included in their larger community's preparedness plan. The commenter stated that the lack of inclusion often occurs despite the willingness and request on the part of the PRTF. The commenter recommended that we allow documentation of best efforts to be a part of the community disaster drill to meet this requirement.

Response: We recognize the existence of a lack of community collaboration in some areas as it relates to emergency preparedness, which is one of the reasons why we are seeking to establish unified emergency preparedness standards for Medicare and Medicaid providers and suppliers. We stated in the proposed rule that if a community disaster drill is not available, we would require a PRTF to conduct an individual facility-based disaster drill/full-scale exercise. A PRTF is expected to document its efforts to participate in a community disaster drill; however, the requirement to conduct a facility-based disaster drill/full-scale exercise would still need to be met.

After consideration of the comments we received on the proposed emergency preparedness requirements for PRTFs, and the general comments we received on the proposed rule in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for PRTFs with the following modifications:

• Revising the introductory text of § 441.184 by adding the term “local” to clarify that PRTFs must also comply with local emergency preparedness requirements.
• Revising § 441.184(a)(4) to delete the term “ensuring” and to replace the term “ensure” with “maintain.”
• Revising § 441.184(b)(1)(i) by adding that PRTFs must have policies and procedures that address the need to sustain pharmaceuticals during an emergency.
• Revising § 441.184(b)(2) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered residents. We have also revised paragraph (b)(2) to provide that if on-duty staff and sheltered residents are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 441.184(b)(5) to change the phrase “ensures records are secure and readily available” to “secures and maintain availability of records.”
• Revising § 441.184(b)(7) to replace the term “ensure” with “maintain.”
• Revising § 441.184(c) by adding the term “local” to clarify that the PRTF must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 441.184(c)(5) to clarify that PRTFs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 441.184(d) by adding that each PRTF's training and testing program must be based on the PRTF's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 441.184(d)(1)(iii) to replace the phrase “ensure that staff can demonstrate” to “Demonstrate staff knowledge.”
• Revising § 441.184(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 441.184(d)(2)(ii) to allow a PRTF to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 441.184(e) to allow a separately certified PRTF within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

H. Emergency Preparedness Regulations for Programs of All-Inclusive Care for the Elderly (PACE) (§ 460.84)

The Balanced Budget Act (BBA) of 1997 established the Program of All-Inclusive Care for the Elderly (PACE) as a permanent Medicare and Medicaid provider type. Under sections 1894 and 1934 of the Act, a state participating in PACE must have a program agreement with CMS and a PACE organization. Regulations at § 460.2 describe the statutory authority that permits entities to establish and operate PACE programs under section 1894 and 1934 of the Act and § 460.6 defines a PACE organization as an entity that has in effect a PACE program agreement. Sections 1894(a)(3) and 1934(a)(3) of the Act define a “PACE provider.” The PACE model of care includes the provision of adult day healthcare and interdisciplinary team care management as core services. Medical, therapeutic, ancillary, and social support services are furnished in the patient's residence or on-site at a PACE center. Hospital, nursing home, home health, and other specialized services are furnished under contract. A PACE organization provides medical and other support services to patients predominantly in a PACE adult day care center. As of June 2016, there are 119 PACE programs nationally.

Regulations for PACE organizations at part 460, subparts E through H, set out the minimum health and safety standards a facility must meet in order to obtain Medicare certification. The current CoPs for PACE organizations include some requirements for emergency preparedness. We proposed to remove the current PACE organization requirements at § 460.72(c)(1) through (5) and incorporate these existing requirements into proposed § 460.84, Emergency preparedness requirements for Programs of All-Inclusive Care for the Elderly (PACE).

Currently § 460.72(c)(1), Emergency and disaster preparedness procedures, states that the PACE organization must establish, implement, and maintain documented procedures to manage medical and nonmedical emergencies and disasters that are likely to threaten the health or safety of the patients, staff, or the public. Currently § 460.72(c)(2) defines emergencies to include, but not be limited to: Fire; equipment, water, or power failure; care-related emergencies; and natural disasters likely to occur in the organization's geographic area.

We proposed incorporating the language from § 460.72(c)(1) into § 460.84(b). Existing § 460.72(c)(2), which defines various emergencies, would be incorporated into § 460.84(b) as well. We did not add the statement in current § 460.72(c)(2), that “an organization is not required to develop emergency plans for natural disasters that typically do not affect its geographic location” because we proposed that PACE organizations utilize an “all-hazards” approach at § 460.84(a)(1).

Existing § 460.72(c)(3), which states that a PACE organization must provide appropriate training and periodic orientation to all staff (employees and contractors) and patients to ensure that staff demonstrate a knowledge of emergency procedures, including informing patients what to do, where to go, and whom to contact in case of an emergency, would be incorporated into proposed § 460.84(d)(1). The existing requirements for having available emergency medical equipment, for having staff who know how to use the equipment, and having a documented plan to obtain emergency medical assistance from outside sources in current § 460.72(c)(4) would be relocated to proposed § 460.84(b)(9). Finally, current § 460.72(c)(5), which states that the PACE organization must test the emergency and disaster plan at least annually and evaluate and document its effectiveness would be addressed by proposed § 460.84(d)(2). The current version of § 460.72(c)(1) through (5) would be removed.

We proposed that PACE organizations adhere to the same requirements for emergency preparedness as hospitals, with three exceptions. We did not propose that PACE organizations provide for basic subsistence needs of staff and patients, whether they evacuate or shelter in place, including food, water, and medical supplies; alternate sources of energy to maintain temperatures to protect patient health and safety and for the safe and sanitary storage of provisions; emergency lighting; and fire detection, extinguishing, and alarm systems; and sewage and waste disposal as we proposed for hospitals at § 482.15(b)(1). The second difference between the proposed hospital emergency preparedness requirements and the proposed PACE emergency preparedness requirements was that we proposed adding at § 460.84(b)(4) a requirement for a PACE organization to have policies and procedures to inform state and local officials at any time about PACE patients in need of evacuation from their residences due to an emergency situation, based on the patient's medical and psychiatric conditions and home environment. Such policies and procedures must be in accord with the HIPAA Privacy Rule, as appropriate.

Finally, the third difference between the proposed requirements for hospitals and the proposed requirements for PACE organizations was that, at § 460.84(c)(7), we proposed to require these organizations to have a communication plan that includes a means of providing information about their needs and their ability to provide assistance to the authority having jurisdiction or the Incident Command Center, or designee. We did not propose requiring these organizations to provide information regarding their occupancy, as we proposed for hospitals (§ 482.15(c)(7)), since the term “occupancy” refers to occupancy in an inpatient facility.

Comment: Several commenters, including PACE providers, opposed our proposal to require PACE organizations to provide for the subsistence needs of staff and participants whether they evacuated or sheltered in place during an emergency; while other providers stated that to do so would be a proactive measure to provide provisions for even a short amount of time. Some providers stated that these provisions should be available to this medically vulnerable, at-risk population during an emergency or if shelter in place occurred for a period of time.

Response: We appreciate the variety of responses we received. Based on the comments we received suggesting we include this requirement, we are now adding a requirement that PACE organizations must have policies and procedures in place to address subsistence needs.

Comment: A commenter wanted us to define the term “all-hazards” for PACE organizations. Another commenter requested clarification when facility-based and community-based assessments are assessed at a “zero risk”, if this would need to be included in their emergency plan.

Response: The definition of “all-hazards” is discussed under the requirements for hospitals and this definition applies to all provider and supplier types. If there is an assessed zero risk made during the facility and community assessments, then there is no need to include this in their emergency plan.

Comment: A few commenters, including a PACE association and PACE providers, requested further clarification on the requirement that PACE organizations develop and maintain emergency preparedness communication plans that provide “well-coordinated” participant care both within the affected facilities as well as across public health departments and emergency systems. The commenters stated that it would be helpful to have a defined “checklist” by which PACE organizations could determine whether or not they are meeting the requirements to be considered “well-coordinated.”

Response: We recognize the importance of this inquiry and suggest that facilities look to the forthcoming interpretive guidelines after the publication of this final rule for more information. We also continue to encourage facilities to seek guidance from the many emergency preparedness resources we have included in the proposed and final rules.

After consideration of the comments we received on the proposed emergency preparedness requirements for PACE organizations, and the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for PACEs with the following modifications:

• Revising the introductory text of § 460.84 by adding the term “local” to clarify that PACE organizations must also coordinate with local emergency preparedness requirements.
• Revising § 460.84(a)(4) to delete the term “ensuring” and to replace the term “ensure” with “maintain.”
• Adding § 460.84(b)(1) to address subsistence needs, and renumbering the rest of the section accordingly.
• Revising § 460.84(b)(2) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered participants. We have also revised paragraph (b)(2) to provide that if on-duty staff and sheltered participants are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 460.84(b)(5) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records;” also revising paragraph (b)(7) to change the term “ensure” to “maintain.”
• Revising § 460.84(c) by adding the term “local” to clarify that the PACE organization must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 460.84(c)(5) to clarify that the PACE organization must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 460.84(d) by adding that each PACE organization's training and testing program must be based on the PACE organization's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 460.84(d)(1)(iii) to replace the phrase “Ensure that staff can demonstrate knowledge” to “Demonstrate staff knowledge.”
• Revising § 460.84(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 460.84(d)(2)(ii) to allow a PACE organization to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 460.84(e) to allow a separately a certified PACE organization within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

I. Emergency Preparedness Regulations for Transplant Centers (§ 482.78)

All transplant centers are located within hospitals. Any hospital that furnishes organ transplants and other medical and surgical specialty services for the care of transplant patients is a transplant hospital (42 CFR 482.70). Therefore, transplant centers must meet all hospital CoPs at §§ 482.1 through 482.57 (as set forth at § 482.68(b)), and the hospitals in which they are located must meet the provisions of § 482.15. The transplant hospital would be responsible for the emergency preparedness program for the entire hospital as set forth in § 482.15, including the transplant center. In addition, unless otherwise specified, heart, heart-lung, intestine, kidney, liver, lung, and pancreas transplant centers must meet all requirements for transplant centers at §§ 482.72 through 482.104.

Transplant centers are responsible for providing organ transplantation services from the time of the potential transplant candidate's initial evaluation through the recipient's post-transplant follow-up care. In addition, if a center performs living donor transplants, the center is responsible for the care of the living donor from the time of the initial evaluation through post-surgical follow-up care.

There are 770 Medicare-approved transplant centers. These centers provide specialized services that are not available at all hospitals. Thus, we believe that it is crucial for every transplant center to work closely with the hospital in which it is located and the designated organ procurement organization (OPO) for that donation service area (DSA) (unless the hospital has a waiver approved by the Secretary to work with another OPO) in preparing for emergencies so that it can continue to provide transplantation and transplantation-related services to its patients during an emergency.

We proposed to add a new transplant center CoP at § 482.78, “Emergency preparedness.” Proposed § 482.78(a) would require a transplant center to have an agreement with at least one other Medicare-approved transplant center to provide transplantation services and other care for its patients during an emergency. We also proposed at § 482.78(a) that the agreement between the transplant center and another Medicare-approved transplant center that agreed to provide care during an emergency would have to address, at a minimum: (1) The circumstances under which the agreement would be activated; and (2) the types of services that would be provided during an emergency.

Currently, under the transplant center CoP at § 482.100, Organ procurement, a transplant center is required to ensure that the hospital in which it operates has a written agreement for the receipt of organs with the hospital's designated OPO that identifies specific responsibilities for the hospital and for the OPO with respect to organ recovery and organ allocation. We proposed at § 482.78(b) to require transplant centers to ensure that the written agreement required under § 482.100 also addresses the duties and responsibilities of the hospital and the OPO during an emergency. We included a similar requirement for OPOs at § 486.360(c) in the proposed rule. We anticipated that the transplant center, the hospital in which it is located, and the designated OPO would collaborate in identifying their specific duties and responsibilities during emergency situations and include them in the agreement.

We did not propose to require transplant centers to provide basic subsistence needs for staff and patients, as we are proposing for hospitals at § 482.15(b)(1). Also, we did not propose to require transplant centers to separately comply with the proposed hospital requirement at § 482.15(b)(8) regarding alternate care sites identified by emergency management officials. This requirement would be applicable to inpatient providers since the overnight provision of care could be challenged in an emergency. The hospital in which the transplant center is located would be required under § 482.15 to provide for any transplant patients and living donors that are hospitalized during an emergency.

Comment: Commenters stated that the proposed requirement for transplant centers to have an agreement with at least one other Medicare-approved transplant center to provide transplantation services and related care for its patients during an emergency was unnecessary. They noted that transplant centers have a long history of cooperating with each other during emergencies, such as during Hurricanes Katrina and Rita. A commenter noted that they had never heard of any transplant center that failed to ensure that its patients received appropriate care during an emergency. Many commenters noted that the Organ Procurement and Transplantation Network (OPTN) already has emergency preparedness requirements and that we should rely on the OPTN and the United Network for Organ Sharing (UNOS) to work with transplant centers during emergencies. Specifically, OPTN Policy 1.4.A Regional and National Emergencies, which was effective on September 1, 2014, states that “[d]uring a regional or national emergency, the OPTN contractor will attempt to distribute instructions to all transplant hospitals and OPOs that describe the impact and how to proceed with organ allocation, distribution, and transplantation” (accessed at http://optn.transplant.hrsa.gov/ContentDocuments/OPTN_Policies.pdf#nameddest=Policy_01 on February 24, 2015). Additional policies instruct transplant centers and OPOs to contact the OPTN contractor for instructions when the transportation of organs is either not possible or severely impaired (OPTN Policy 1.4.B), and when communication through the internet or telephone is not possible (OPTN Policies 1.4.C, 1.4.D, and 1.4.E). If any additional emergency preparedness requirements are necessary, those requirements should be under the auspices of the OPTN and UNOS or coordinated by these organizations.

Response: We agree with the commenters that transplant centers have a long history of working well with each other. However, we also believe that transplant centers need to be proactive and make at least certain basic preparations for emergency situations. The OPTN does have emergency preparedness requirements. However, those requirements are not comprehensive, and we do not believe they are sufficient. For example, those policies cover the transportation of organs and communication interruptions between the OPTN contractor and transplant centers and OPOs. They do not cover local emergencies or even common emergency situations, such as weather-related events in which a transplant center may have a disruption in power or in getting its staff into the hospital. In addition, including emergency preparedness requirements in the transplant CoPs provides us with oversight and enforcement authority and imposes the requirements on transplant programs that received their designation by virtue of their approval for reimbursement for Medicare. The requirements finalized in this rule also should not conflict with the OPTN policies on emergency preparedness.

Comment: Some commenters stated that complying with the proposed requirements would be overly burdensome. Commenters indicated our burden estimates were extremely conservative and that the proposed agreements in § 483.78 could require more than 100 hours, especially for hospitals with multiple transplant programs, and perhaps as many as 200 contracts. In addition, some commenters also indicated that the proposed requirements would result in increased financial burden to patients and their families.

Response: We agree with the commenters. In analyzing the comments we received for the transplant center requirements, we now believe that some of these requirements, especially the proposed requirement for the transplant center to have an agreement with another transplant center, would likely require more resources than we originally estimated. There is also a possibility that there could be some increase in costs to patients and their families. Therefore, we are not finalizing these requirements as proposed for transplant centers to have agreements with other transplant centers or for the transplant center to ensure that the agreement between the hospital in which it is located and the OPO addresses the hospital and the OPO's duties and responsibilities during an emergency in the agreement required by § 486.100, as required in proposed § 482.78. Instead, we are finalizing requirements for transplant centers, the hospitals in which they are located, and the relevant OPOs in developing and maintaining protocols that address the duties and responsibilities of each party during an emergency. We believe the burden on transplant centers, patients, and their families will be less than estimated burden in the proposed rule. See section III.I. of this final rule (Collection of Information Requirements, ICRs Regarding Condition of Participation: Emergency Preparedness for Transplant Centers (§ 482.78)) for our revised burden estimate.

Comment: Many commenters believed that agreements for emergency preparedness between transplant centers would be of little value. Since the affected area during any particular emergency is unknown ahead of time, the transplant center may have an agreement with another transplant center that is also affected by the same emergency. They also noted that, since the circumstances of each natural and man-made disaster would be different, any plans made ahead of time may be unworkable during an actual emergency. They noted that, in each emergency, the affected geographic area has to be taken into consideration, in addition to the services and patients affected. In addition to being of little value, they noted that emergency plans may provide a false sense of security. Also, in some areas of the country, the great geographical distances between transplant centers would make agreements with another center both overly burdensome and impractical.

Response: We believe that emergency preparedness is essential for healthcare entities. Also, emergency preparedness plans should be flexible enough to allow for emergencies that affect both the local area, as well emergencies that may affect a larger area, such as regional and national emergencies. However, we do agree with the commenters that the great geographical distances between some of the transplant centers could result in making agreements between the centers burdensome and impractical. Therefore, we are not finalizing the requirement for agreements with between transplant centers as proposed. Instead, based on our analysis of the comments, we have decided to require that transplant centers be actively involved in their hospital's emergency planning and programming. We believe this requirement will ensure that the needs of each transplant center are addressed in the hospital's program. Also, transplant centers must be involved in the development of mutually-agreed upon protocols that addresses the duties and responsibilities of the hospital, transplant program, and OPO during emergencies. These changes are discussed in more detail later in this final rule.

Comment: Some commenters expressed concerns about how transferring transplant recipients and those on the waiting lists to another transplant center would affect both these patients and those at the receiving transplant center. Since each transplant program develops its own patient selection criteria and, if the transplant center performs living donor transplants, living donor selection criteria, this could result in some patients not being acceptable to the transplant center that agrees to care for patients from another transplant center that is experiencing an emergency. A commenter noted that OPTN Policy 3.4B prohibits transplant hospitals from registering a candidate on a waiting list for an organ if that transplant center does not have current OPTN approval for that type of organ (accessed at http://optn.transplant.hrsa.gov/ContentDocuments/OPTN_Policies.pdf#nameddest=Policy_01 on February 24, 2015). In addition, depending upon the length of time of the emergency, there could be issues regarding how the waiting list patients would be integrated with the receiving transplant center's own waiting list patients. There was some concern that, depending on how the transfer was conducted, some of the transferring waiting list patients could receive preferential treatment over the receiving transplant center's waiting list patients. Also, there were some concerns about how patient records or other relevant information would be transferred. In addition, there was a concern about whether CMS and the OPTN would grant any exceptions or modifications to the required statistics and outcome measures during an emergency, especially if the transferring patients do not meet the receiving facility's selection criteria.

Response: We agree that there could be issues when patients are transferred from one transplant center to another. However, our requirements do not oblige a transplant center that agrees to care for another transplant center's patients during an emergency to put those patients on its waiting lists. We anticipate that most emergencies would be of short duration and that the transplant center that is affected by an emergency will resume its normal operations within a short period of time. However, if a transplant center does arrange for its patients to be transferred to another transplant center during an emergency, both transplant centers would need to determine what care would be provided to the transferring patients, including whether and under what circumstances the patients from the transferring transplant center would be added to the receiving center's waiting lists.

Concerning exceptions or modifications to the required statistics and outcome measures for operations during an emergency, we believe that is beyond the scope of this final rule. We would note that the current survey, certification, and enforcement procedures already provide for transplant centers to request consideration for mitigating factors in both the initial and re-approval processes for their center as set forth in § 488.61(f). In addition, there are specific requirements for requests related to natural disasters and public health emergencies (§ 488.61(f)(2)(vii)).

Comment: Some commenters expressed concern that our proposed requirements would interfere with or contradict OPTN policies. A commenter specifically noted that, in the preamble to the proposed rule, we stated that “[i]deally, the Medicare-approved transplant center that agrees to provide care for a center's patients during an emergency would perform the same type of organ transplant as the center seeking the agreement. However, we recognize that this may not always be feasible. Under some circumstances, a transplant center may wish to establish an agreement for the provision of post-transplant care and follow-up for its patients with a center that is Medicare-approved for a different organ type” (78 FR 79108). The commenter noted that OPTN Policy 3.4.B states that “[m]embers are only permitted to register a candidate on the waiting list for an organ at a transplant program if the transplant program has current OPTN transplant program approval for that organ type.”

Response: We disagree with the commenters. We do not expect any transplant center to violate any of the OPTN's policies. We are not finalizing the proposed requirement for transplant centers to have agreements with another transplant center because we now believe that requirement may be burdensome and impractical for some transplant centers as we have discussed earlier. However, if a transplant center choses to have an agreement with another transplant center to care for its patients during an emergency, there is no requirement for the receiving center to place those patient on its waiting lists. The receiving transplant center would likely only provide care for the duration of the emergency and then those patients would return to their original transplant center. However, what care was to be provided should be decided by the transplant centers prior to any emergency. Also, as stated earlier, the OPTN's policies are not comprehensive. For example, they do not cover local emergencies or the other specific requirements in this final rule, that is, requirements for a risk assessment, specific policies and procedures, an emergency plan, a communication plan, and training and testing. In addition, as described earlier, including emergency preparedness requirements in the transplant center CoPs provides us with oversight and enforcement authority we do not have for the OPTN policies.

Comment: A few commenters stated that the proposed transplant center requirements were unnecessary. The transplant center should be embedded in the hospital's overall emergency plan so that transplant patients would be considered along with all of the other patients in the hospital. Another commenter suggested that this agreement not be between different transplant centers but the hospitals in which they are located, or even part of a larger or regional emergency plan.

Response: We agree with the commenters that the transplant center's emergency preparedness plans should be included in the hospital's emergency plans. All of the Medicare-approved transplant centers are located within hospitals and, as part of the hospital, should be included in the hospital's emergency preparedness plans. In addition, if transplant centers were required to separately comply with all of the requirements in § 482.15, it would be tremendously burdensome to the transplant centers. For example, we believe that the transplant center needs to be involved in the hospital's risk assessment because there may be risks to the transplant center that others in the hospital may not be aware of or appreciate. However, most of the risk assessment would be the same since the transplant center is located in the hospital; a separate risk assessment would unnecessary and overly burdensome. Therefore, we have modified § 482.68(b) so that transplant centers are exempt from the emergency preparedness requirements in § 482.15 and added a requirement in § 482.15(g) that requires transplant hospitals to have a representative from each transplant center actively involved in the development and maintenance of the hospital's emergency preparedness program. In addition, transplant centers would still be required to have their own emergency preparedness policies and procedures, as well as participate in mutually-agreed upon protocols that address the transplant center, hospital, and OPO's duties and responsibilities during an emergency.

Comment: Some commenters recommended that, instead of requiring agreements between transplant centers and OPOs as we had proposed, we should require hospitals, transplant centers, and OPOs to develop mutually agreed-upon protocols for addressing emergency situations. These commenters pointed out that since we proposed that emergency plans be reviewed and updated annually and that changes be incorporated based upon new information, protocols would be more conducive to timely and effective improvement. Other commenters noted that certain factors that would need to be considered in an emergency, particularly the different facility-specific levels of service, geographically based hazards, and donor potentials, were inappropriate for formal agreements but were well suited for protocols.

Response: We agree with the commenters. We believe that mutually agreed-upon protocols between the transplant centers, the hospitals in which the transplant centers operate, and the OPOs are the best approach to address emergency preparedness for these facilities. Therefore, we are not finalizing the requirement at proposed § 482.78 that a transplant center or the hospital in which it operates have an agreement with another transplant center, or the requirement that the agreement required at § 486.100 include the duties and responsibilities of the OPO and hospital during an emergency. Instead, we have revised the requirements for transplant centers, the hospitals in which they operate, and OPOs to specify that these facilities must have mutually agreed-upon protocols that state the duties and responsibilities of each during an emergency. We believe this approach will not only achieve our goal of having these facilities prepared for emergencies but will also impose only minimal burden. Section 486.344(d) currently requires that OPOs have protocols with transplant centers and § 482.100 requires that transplant centers ensure that the hospitals in which they operate have written agreements for the receipt of organs with an OPO designated by the Secretary that identifies specific responsibilities for the hospital and for the OPO with respect to organ recovery and organ allocation according to § 482.100. In addition, since most, if not all, of these facilities must have previously encountered emergencies, we believe that establishing these protocols should require a much smaller burden than developing an agreement.

After consideration of the comments we received on those changes in the proposed rule, as discussed earlier and in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for transplant centers with the following modifications:

• Adding a requirement at § 482.15(g) that a transplant center be actively involved in the hospital's emergency preparedness planning and program, and the phrase “as defined by § 482.70”.
• Modifying § 482.68(b) to exempt transplant centers from the requirements in § 482.15.
• Removing the requirement in § 482.78 for transplant centers to have agreements with another transplant center.
• Modifying the requirement in § 482.78(b) to require that a transplant center be responsible for developing and maintaining mutually agreed upon protocols that address the duties and responsibilities of the transplant center, hospital, and OPO during an emergency.
• Adding “as defined by § 482.70” that sets forth the definition of a “transplant hospital” to clarify which hospitals are responsible for complying with § 482.15(g).

J. Emergency Preparedness Requirements for Long Term Care (LTC) Facilities (§ 483.73)

Section 1819(a) of the Act defines a skilled nursing facility (SNF) for Medicare purposes as an institution or a distinct part of an institution that is primarily engaged in providing skilled nursing care and related services to patients that require medical or nursing care or rehabilitation services due to an injury, disability, or illness. Section 1919(a) of the Act defines a nursing facility (NF) for Medicaid purposes as an institution or a distinct part of an institution that is primarily engaged in providing to patients: skilled nursing care and related services for patients who require medical or nursing care; rehabilitation services due to an injury, disability, or illness; or, on a regular basis, health-related care and services to individuals who due to their mental or physical condition require care and services (above the level of room and board) that are available only through an institution.

To participate in the Medicare and Medicaid programs, long-term care (LTC) facilities must meet certain requirements located at part 483, Subpart B, Requirements for Long Term Care Facilities. SNFs must be certified as meeting the requirements of section 1819(a) through (d) of the Act. NFs must be certified as meeting section 1919(a) through (d) of the Act. A LTC facility may be both Medicare and Medicaid approved.

LTC facilities provide a substantial amount of care to Medicare and Medicaid beneficiaries, as well as “dually eligible individuals” who qualify for both Medicare and Medicaid. As of June 2016, there were 15,699 LTC facilities and these facilities provided care for about 1.7 million patients.

The existing requirements for LTC facilities contain specific requirements for emergency preparedness, set out at § 483.75(m)(1) and (2). Section 483.75(m)(1) states that a facility must have detailed written plans and procedures to meet all potential emergencies and disasters, such as fire, severe weather, and missing residents. We proposed that this language be incorporated into proposed § 483.73(a)(1). Existing § 483.75(m)(2) states that a facility must train all employees in emergency procedures when they begin to work in the facility, periodically review the procedures with existing staff, and carry out unannounced staff drills using those procedures. These requirements would be incorporated into proposed § 483.73(d)(1) and (2). Section 483.75(m)(1) and (2) would be removed.

Our proposed emergency preparedness requirements for LTC facilities are identical to those we proposed for hospitals at § 482.15, with two exceptions. Specifically, at § 483.73(a)(1), we proposed that in an emergency situation, LTC facilities would have to account for missing residents.

Section 483.73(c) would requires these facilities to develop an emergency preparedness communication plan, which would include, among other things, a means of providing information about the general condition and location of residents under the facility's care. We proposed to add an additional requirement at § 483.73(c)(8) that read, “A method for sharing information from the emergency plan that the facility has determined is appropriate with residents and their families or representatives.”

Also, we proposed at § 483.73(e)(1)(i) that LTC facilities must store emergency fuel and associated equipment and systems as required by the 2000 edition of the Life Safety Code (LSC) of the NFPA®. In addition to the emergency power system inspection and testing requirements found in NFPA® 99, NFPA® 101, and NFPA® 110, we proposed that LTC facilities test their emergency and stand-by-power systems for a minimum of 4 continuous hours every 12 months at 100 percent of the power load the LTC facility anticipates it would require during an emergency.

However, we also solicited comments on whether there should be a specific requirement for “residents' power needs” in the LTC requirements.

Comment: Some commenters recommended that LTC facilities be required to include patients, their families, and relevant stakeholders throughout the emergency preparedness planning and testing process. They recommended that the method of providing information from the emergency plan be clearly communicated with residents, representatives, and caregivers and that the LTC facilities follow a specific time frame to provide this communication. Some commenters recommended that PACE facilities and HHAs be required to include patients and their families in the emergency preparedness planning as well.

A few commenters recommended that LTC facilities include their state Long-Term Care Ombudsman Program in this planning process. Some commenters also recommended that LTC facilities provide the Program with a completed emergency plan.

Response: As we stated in the proposed rule, LTC facilities are unlike many of the inpatient care providers. Many of the residents have long term or extended stays in these facilities. Due to the long term nature of their stays, these facilities essentially become the residents' homes. We believe this fact changes the nature of the relationship with the residents and their families or representatives.

We continue to believe that each facility should have the flexibility to determine the information that is most appropriate to be shared with its residents and their families or representatives and the most efficient manner in which to share that information. Therefore, we are finalizing our proposal at § 483.73(c)(8) that LTC facilities develop and maintain a method for sharing information from the emergency plan that the facility has determined is appropriate with residents and their families or representatives. We note that we are not requiring that PACE and HHA providers share information from the emergency plan with families and their representatives. However, these providers can choose to share information with any appropriate party, so long as they comply with federal, state, and local laws.

We are not requiring LTC facilities to share information with stakeholders, or Long-Term Care Ombudsman Program representatives, because we believe such a requirement could be overly burdensome for the LTC facilities. We believe that facilities need the flexibility to develop their emergency plans and determine what portions of those plans and the parties with whom those plans should be shared. If a facility determines that it is appropriate and timely to share either the complete emergency plan, or certain portions of it, with stakeholders or representatives from the Long-Term Care Ombudsman Program, we encourage them to do so. Therefore, we are finalizing our proposal at § 483.73(c)(2)(iii) that LTC facilities maintain the contact information for the Office of the State Long-Term Care Ombudsman.

Comment: A majority of commenters expressed support for the proposal that requires LTC facilities to develop a communications plan. A few commenters also supported CMS' proposal to require LTC facilities to share information from the emergency plan that the facility has determined is appropriate with residents and their families or representatives. A commenter recommended that LTC facilities follow a specific timeframe to provide this communication.

Response: We appreciate the commenters' support. We note that we are not requiring specific timeframes for LTC facility communications in these emergency preparedness requirements. We are allowing facilities the flexibility to make the determination on when emergency preparedness plans and information should be communicated with the relevant entities during an emergency or disaster.

Comment: A commenter specifically recommended that CMS issue guidance to facilities regarding steps to disseminate information about the emergency plan to the general public. These steps would include posting the plan on the facility's Web site, if available, making a hard copy available for review at the facility's front desk; providing a notice to residents upon entering a facility that they or their representative can receive a free electronic copy at any time by providing their email address, and proving a copy of the plan in electronic format to local entities that are a resource for families during a disaster. A commenter recommended that CMS require LTC facilities to make the plans available to residents and their representatives upon request. According to the commenter, information that the facility shares should be written in clear and concise language and the facility's Web site could be a place for current, updated information.

Response: We agree with the commenter that transparency in communication is important. Therefore, we are requiring that LTC facilities have a method for sharing appropriate information with residents and their families or representatives. Consistent with our belief that these emergency preparedness requirements should afford facilities flexibility, we do not believe that it is appropriate to require that LTC facilities take specific steps or utilize specific strategies to share these documents with residents and their families or representatives.

Comment: A commenter stated that the communication plan requirement is broad and will lead to inconsistent approaches for facilities. Furthermore, the commenter noted that this will cause compliance and enforcement of the rule to be subjective.

Response: The proposed emergency preparedness regulations provide the minimum requirements that facilities must follow. This allows a variety of facilities, ranging from small rural providers to large facilities that are part of a franchise or chain, the flexibility to develop communication plans that are specific to the needs of their resident population and facility. Additionally, we have written these regulations with the intention to allow for flexibility in how facilities develop and maintain their emergency preparedness plans.

In addition to the CoPs/CfCs, interpretative guidelines (IGs) will be developed for each provider and supplier types. We also note that surveyors will be provided training on the emergency preparedness requirements, so that enforcement of the rule will be based on the regulations set forth here.

Comment: A commenter noted that the proposed requirements for a communication plan for LTC facilities do not mention a waiver that would allow for sharing of client information, which would create a potential violation of HIPAA. Furthermore, the commenter requested clarification in the final rule.

Response: As we stated previously in this final rule, HIPAA requirements are not suspended during a national or public health emergency. Thus, the communication plan is to be created consistent with the HIPAA Rules. See http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/hipaa-privacy. http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/emergency/hipaa-privacy-emergency-situations.pdf , for more information on how HIPAA applies in emergency situations.

Comment: A commenter stated that LTC facilities should consider multiple options for transportation in planning for an evacuation. Another commenter recommended that there should be coordination between vendors that provide transportation services for LTC facility residents with other facilities and community groups to avoid having too many providers relying on a few vendors.

Response: We agree with the commenters that it is preferable for facilities to have multiple options for the provision of services, including transportation, and that those services be coordinated so that they are used efficiently. We also encourage facilities to coordinate with other facilities in their geographic area to determine if their arrangements with any service provider are realistic. For example, if two LTC facilities in the same city are depending upon the same transportation vendor to evacuate their residents, both facilities should ensure that the vendor has sufficient vehicles and personnel to evacuate both facilities. Also, we believe that the requirements for testing that are set forth in § 483.73(d)(2), especially the full-scale exercise, should provide facilities with the opportunity to test their emergency plans and determine if they need to include multiple options for services and whether those services have been coordinated.

Comment: Due to the difficulty that the training requirement would place on smaller LTC facilities, a commenter suggested that we allow training by video demonstration, webinar, or by association-sponsored programs where regional training can be given to the staff of several facilities simultaneously. The commenter pointed out that group training would also bring about more in-depth discussion, questions, and comments.

Response: We agree that these training styles could be beneficial. Our proposed requirement for emergency preparedness training does not limit training types to within the facility only.

Comment: CMS solicited comments on whether LTC facilities should be required to provide the necessary electrical power to meet a resident's individualized power needs. Some organizations recommended that the regulation include specific requirements for a “resident's power needs.” However, many commenters were opposed to this requirement. Opposing commenters stated that in an emergency, based on the emergency and available resources, things such as medically sustaining life support equipment would be needed rather than a powered wheelchair and the individual facility would be best at making that determination. Some commenters recommended that the final regulation state that power needs would be managed by the providers based on priority to address critical equipment and systems both for individual needs as well as the needs of the entire facility.

Response: We appreciate the feedback that we received from commenters on this issue. We agree that the needs of the most vulnerable residents should be considered first and expect that facilities would take the needs of their most vulnerable population into consideration as part of their daily operations. At § 483.73(a)(3) we require that the facility's emergency plan address their resident population to include persons at-risk, the type of services the facility has the ability to provide in an emergency, and continuity of their operations. We agree with commenters, and want facilities to have the flexibility to conduct their risk assessment, individually assess their population, and determine in their plans how they will meet the individual needs of their residents. We believe that the individual power needs of the residents are encompassed within the requirement that the facility assess its resident population. Therefore, we are not adding a specific requirement for LTC facilities to provide the necessary power for a resident's individualized power needs. However, we encourage facilities to establish policies and procedures in their emergency preparedness plan that would address providing auxiliary electrical power to power dependent residents during an emergency or evacuating such residents to alternate facilities. If a power outage occurs during an emergency or disaster, power dependent residents will require continued electrical power for ventilators, speech generator devices, dialysis machines, power mobility devices, certain types of durable medical equipment, and other types of equipment that are necessary for the residents' health and well-being. We therefore reiterate the importance of protecting the needs of this vulnerable population during an emergency.

Comment: A commenter objected to our proposal to require LTC facilities to have policies and procedures that addressed alternate sources of energy to maintain sewage and waste disposal. The commenter indicated that the provision and restoration of sewage and waste disposal systems may well be beyond the operational control of some providers.

Response: We agree with the commenter that the provision and restoration of sewage and waste disposal systems could be beyond the operational control of some providers. However, we are not requiring LTC facilities to have onsite treatment of sewage or to be responsible for public services. LTC facilities would only be required to make provisions for maintaining the necessary services.

Comment: A commenter noted that the proposed requirements do not address the issue of regional evacuation. This commenter believed that this was an essential part of an emergency plan and that the plan must address transportation and accommodations for people with physical, intellectual, or cognitive impairments. The commenter also recommended that the regional evacuation plan account for long-term sheltering and that there be specific standards for sheltering-in-place. Also, they believed that LTC facilities should be required to adopt the 2007 EP checklist that was issued by CMS.

Response: We agree with the commenter that the emergency plans for LTC facilities should address regional as well as local evacuations and long-term as well as short-term sheltering-in-place. However, we are finalizing the requirement for the emergency plan to be based upon a facility-based and community-based risk assessment, utilizing an all-hazards approach (§ 483.73(a)(1)). The “all-hazards” approach includes emergencies that could affect only the facility as well as the community in which it is located and beyond. It also includes emergencies that are both short-term and long-term. When facilities are developing their risk assessments, they should be considering all of those possibilities. We disagree about the recommendation that we propose more specific standards on sheltering-in-place. We believe that each facility needs the flexibility to develop its own plans for sheltering-in-place for both short and long-term use. We also disagree about requiring adoption of the 2007 CMS EP checklist, which can be found at https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/Downloads/SandC_EPChecklist_Persons_LTCFacilities_Ombudsmen.pdf .

That checklist is a resource that facilities may use. In addition, over time CMS may publish updates or other checklists or facilities may choose to use tools from other resources.

Comment: A commenter agreed with us that LTC facilities should have plans concerning missing residents. The current LTC requirements require LTC facilities have plan for emergencies, including missing residents (§ 483.75(m)). However, the commenter also believed that this requirement could be confusing and that we should clarify that facilities should have plans to account for missing residents in both emergency and non-emergency situations.

Response: We agree with the commenter that LTC facilities must have plans concerning missing residents that can be activated regardless of whether the facility must activate its emergency plan. A missing resident is an emergency and LTC facilities must have a plan to account for or locate the missing resident.

Comment: Some commenters wanted more clarification on the requirements for LTC facilities to have policies and procedures that address subsistence needs for staff and residents, particularly related to medical supplies and temperature to protect resident health and safety and for safe and sanitary storage of provisions. A commenter requested additional guidance and clarification on medical supplies. They questioned whether “supplies” would include individual residents' medications and, if it did, how that affected prescribing limits, payment systems, access, etc. Furthermore, a commenter wanted clarification on power requirements for temperatures. Another commenter recommended we specify a minimum for all needed supplies and provisions.

Response: We have not required minimums for these types of requirements because they would vary greatly between facilities. Each facility is required to conduct a facility-based and community-based assessment that addresses, among other things, its resident population. From that assessment, each facility should be able to identify what it needs for its resident population, including what medical/pharmaceutical supplies it needs to maintain and its temperature needs for both its resident population and its necessary provisions. As to minimum time periods, each facility would need to determine those based on its assessment and any other applicable requirements.

Comment: A commenter recommended that we require specific types of medical documentation in proposed § 483.73(b)(5). The commenter specifically recommended the inclusion of resident demographics, allergies, diagnosis, list of medications and contact information (commonly referred to as the “face sheet”).

Response: We appreciate the commenter's suggestion. Proposed § 483.73(b)(5) required that the facility have policies and procedures that address “A system of medical documentation that preserves resident information, protects confidentiality of resident information, and ensures records are secure and readily available.” While the types of documentation the commenter identified will probably be included in that documentation, we believe that facilities need the flexibility to determine what will be included in the medical documentation and how they will develop these systems. Thus, we are finalizing this provision as proposed.

After consideration of the comments we received on the proposals, and the general comments we received on the proposed rule, as discussed earlier in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for LTC facilities with the following modifications:

• Revising the introductory text of § 483.73 by adding the term “local” to clarify that LTC facilities must also comply with local emergency preparedness requirements.
• Revising § 483.73(a) to change the term “ensure” to “maintain.”
• Revising § 483.73(b)(1)(i) to state that LTC facilities must have policies and procedures that address the need to sustain pharmaceuticals during an emergency.
• Revising § 483.73(b)(2) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered residents. We have also revised paragraph (b)(2) to provide that if on-duty staff and sheltered residents are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 483.73(b)(5) to replace the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Revising § 483.73(b)(7) to replace the term “ensure” with “maintain.”
• Revising § 483.73(c) by adding the term “local” to clarify that the LTC facility must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 483.73(c)(5) to clarify that the LTC facility must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 483.73(d) by adding that each LTC facility's training and testing program must be based on the LTC facility's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 483.73(d)(1)(iv) to replace the phrase “Ensure that staff can demonstrate knowledge” with “Demonstrate staff knowledge.”
• Revising § 483.73(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 483.73(d)(2)(ii) to allow a LTC facility to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Revising § 483.73(e)(1) and (2) by removing the requirement for additional generator testing.
• Revising § 483.73(e)(2)(i) by removing the requirement for an additional 4 hours of generator testing and by clarifying that LTC facilities must meet the requirements of NFPA® 99, 2012 edition and NFPA® 110, 2010 edition.
• Revising § 483.73(e)(3) by removing the requirement that LTC facilities maintain fuel quantities onsite and clarify that LTC facilities must have a plan to maintain operations unless the LTC facility evacuates.
• Adding § 483.73(f) to allow a separately certified LTC facility within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.
• Adding a new § 483.73(g) to incorporate by reference the requirements of 2012 NFPA® 99, 2012 NFPA® 101, and 2010 NFPA® 110.

K. Emergency Preparedness Regulations for Intermediate Care Facilities for Individuals With Intellectual Disabilities (ICF/IIDs) (§ 483.475)

Section 1905(d) of the Act created the ICF/IID benefit to fund “institutions” with four or more beds to serve people with [intellectual disability] or other related conditions. To qualify for Medicaid reimbursement, ICFs/IID must be certified and comply with CoPs at 42 CFR part 483, subpart I, §§ 483.400 through 483.480. As of June 2016, there were 6,237 ICFs/IID, serving approximately 129,000 clients, and all clients receiving ICF/IID services must qualify financially for Medicaid assistance under their applicable state plan. Clients with intellectual disabilities who receive care provided by ICF/IIDs may have additional emergency planning and preparedness requirements. For example, some care recipients are non-ambulatory, or may experience additional mobility or sensory disabilities or impairments, seizure disorders, behavioral challenges, or mental health challenges.

Because ICF/IIDs vary widely in size and the services they provide, we expect that the risk analyses, emergency plans, emergency policies and procedures, emergency communication plans, and emergency preparedness training will vary widely as well. However, we believe each of them has the capability to comply fully with the requirements so that the health and safety of its clients are protected in the event of an emergency situation or disaster.

Thus, we proposed to require that ICF/IIDs meet the same requirements we proposed for hospitals, with two exceptions. At § 483.475(a)(1), we proposed that ICF/IIDs utilize an all-hazards approach, including plans for locating missing clients. We believe that in the event of a natural or man-made disaster, ICF/IIDs would maintain responsibility for care of their own client population but would not receive patients from the community. Also, because we recognize that all ICF/IIDs clients have unique needs, we proposed to require ICF/IIDs to “address the unique needs of its client population . . .” at § 483.475(a)(3).

In addressing the unique needs of their client population, we believe that ICF/IIDs should consider their individual clients' power needs. For example, some clients could have motorized wheelchairs that they need for mobility, or require a continuous positive airway pressure or CPAP machine, due to sleep apnea. We believe that the proposed requirements at § 483.475(a) (a risk assessment utilizing an all-hazards approach and that the facility address the unique needs of its client population) encompass consideration of individual clients' power needs and should be included in ICF/IIDs risk assessments and emergency plans.

As we stated earlier, the purpose of this final rule is to establish requirements to ensure that Medicare and Medicaid providers and suppliers are prepared to protect the health and safety of patients in their care during more widespread local, state, and national emergencies. We do not believe the existing requirements for ICF/IIDs are sufficiently comprehensive to protect clients during an emergency that impacts the larger community. However, we have been careful not to remove emergency preparedness requirements that are more rigorous than the additional requirements we proposed.

For example, our current regulations for ICF/IIDs include requirements for emergency preparedness. Specifically, § 483.430(c)(2) and (3) contain specific requirements to ensure that direct care givers are available at all times to respond to illness, injury, fire, and other emergencies. However, we did not propose to relocate these existing facility staffing requirements at § 483.430(c)(2) and (3) because they address staffing issues based on the number of clients per building and client behaviors, such as aggression. Such requirements, while related to emergency preparedness tangentially, are not within the scope of the emergency preparedness requirements for ICF/IIDs.

Current § 483.470, Physical environment, includes a standard for emergency plan and procedures at § 483.470(h) and a standard for evacuation drills at § 483.470(i). The standard for emergency plan and procedures at current § 483.470(h)(1) requires facilities to develop and implement detailed written plans and procedures to meet all potential emergencies and disasters, such as fire, severe weather, and missing clients. This requirement will be relocated to proposed § 483.475(a)(1). Existing § 483.470(h)(1) will be removed.

Currently § 483.470(h)(2) states, with regard to a facility's emergency plan, that the facility must communicate, periodically review the plan, make the plan available, and provide training to the staff. These requirements are covered in proposed § 483.475(d). Current § 483.470(h)(2) will be removed.

ICF/IIDs are unlike many of the inpatient care providers. Many of the clients can be expected to have long term or extended stays in these facilities. Due to the long term nature of their stays, these facilities essentially become the clients' residences or homes. Section 483.475(c) requires these facilities to develop an emergency preparedness communication plan, which includes, among other things, a means of providing information about the general condition and location of clients under the facility's care. We did not indicate what information from the emergency plan should be shared or the timing or manner in which it should be disseminated. We believe that each facility should have the flexibility to determine the information that is most appropriate to be shared with its clients and their families or representatives and the most efficient manner in which to share that information. Therefore, we proposed to add an additional requirement at § 483.475(c)(8) that reads, “A method for sharing information from the emergency plan that the facility has determined is appropriate with clients and their families or representatives.”

The standard for disaster drills set forth at existing § 483.470(i)(1) specifies that facilities must hold evacuation drills at least quarterly for each shift of personnel under varied conditions to ensure that all personnel on all shifts are trained to perform assigned tasks; ensure that all personnel on all shifts are familiar with the use of the facility's fire protection features; and evaluate the effectiveness of their emergency and disaster plans and procedures. Currently § 483.470(i)(2) further specifies that facilities must evacuate clients during at least one drill each year on each shift; make special provisions for the evacuation of clients with physical disabilities; file a report and evaluation on each evacuation drill; and investigate all problems with evacuation drills, including accidents, and take corrective action. Furthermore, during fire drills, facilities may evacuate clients to a safe area in facilities certified under the Health Care Occupancies Chapter of the Life Safety Code. Finally, at existing § 483.470(i)(3), facilities must meet the requirements of § 483.470(i)(1) and (2) for any live-in and relief staff they utilize. Because these existing requirements are so extensive, we proposed cross referencing § 483.470(i) (redesignated as § 483.470(h)) at proposed § 483.475(d).

Comment: A commenter recommended that CMS include language that would exclude community-based residential services servicing three or fewer residents. The commenter noted that implementing the same emergency preparedness requirements as ICF/IID facilities for community based residential services would be cost prohibitive.

Response: A community-based residential facility with less than 4 beds would not meet the definition of an ICF/IID and would not be covered under this regulation. We encourage facilities that are concerned about the implementation of emergency preparedness requirements to refer to the various resources noted in the proposed and final rules, and participate in healthcare coalitions within their community for support in implementing these requirements.

Comment: A commenter agreed with CMS' proposal that ICF/IID providers' communication plans be shared with the families of their clients. The commenter noted that an annual correspondence to families, with intermediate updates as changes or additions are made, should not be burdensome to facilities.

Response: We appreciate the commenter's support. We have not set specific requirements for when or how often ICF/IID facilities should correspond with families and their representatives. However, facilities can choose to correspond with clients' families and their representatives as frequently as they deem appropriate.

Comment: Multiple commenters expressed their opposition to the requirement for ICF/IIDs to hold evacuation drills at least quarterly for each shift for personnel under varied conditions. Each commenter stated that quarterly evacuation drills are costly and will require the unnecessary movement of clients which could result in liability issues as well as disrupt operations.

Response: The requirement for quarterly evacuation drills is one of the requirements in the existing regulations for ICF/IIDs at § 483.470(i) (proposed to be redesignated to § 483.470(h)). We stated in the proposed rule that the purpose of the rule was to establish requirements to ensure that Medicare and Medicaid providers and suppliers are prepared to protect the health and safety of patients in their care during a widespread emergency. While we did not believe that the existing requirements for ICF/IIDs are sufficiently comprehensive enough to protect clients during an emergency that impacts the larger community, we were careful not to remove emergency preparedness requirements that are more rigorous than those additional requirements we proposed. Therefore, we proposed to retain this requirement. We believe that, unlike many of the inpatient care providers due to the long term nature of their clients stays, ICF/IIDs have a heightened responsibility to ensure the safety of their clients given that these facilities essentially become the clients' residences or homes.

Comment: A commenter expressed their support for the emphasis that the proposed rule placed on drills and testing for this vulnerable population and pointed out that many accrediting organizations require ICF/IIDs to test their emergency management plans each year.

Response: We thank the commenter for their support and agree that drills and testing are an important aspect of developing a comprehensive emergency preparedness program.

Comment: A commenter stated that the proposed requirement to place a generator in each home and to test it annually would be extremely costly.

Response: We would like to clarify that we did not propose a requirement for generators to be placed in each ICF/IID facility. We proposed additional testing requirements for hospitals, CAHs, and LTC facilities. However, due to the numbers of comments we received stating that the requirement for additional testing would be overly burdensome and unnecessary. We have removed this requirement in the final rule.

After consideration of the comments we received on these provisions of the proposed rule, and the general comments we received, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for ICF/IIDs with the following modifications:

• Revising the introductory text of § 483.475, by adding the term “local” to clarify that ICF/IIDs must also comply with local emergency preparedness requirements.
• Revising § 483.475(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Adding at § 483.475(b)(1)(i) that ICF/IIDs must have policies and procedures that address the need to sustain pharmaceuticals during an emergency.
• Revising § 483.47(b)(2) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered clients. We have also revised paragraph (b)(2) to provide that if on-duty staff and sheltered residents are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 483.475(b)(5) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records;” also revising paragraph (b)(7) to change the term “ensure” to “maintain.”
• Revising § 483.475(b)(1), (b)(1)(ii)(A), and (b)(2) to replace the term “residents” to “clients.” Throughout the preamble discussion, the terms “patients and residents” have been deleted and replaced with the term “client.”
• Revising § 483.475(c) by adding the term “local” to clarify that ICF/IIDs must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 483.475(c)(5) to clarify that ICF/IIDs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 483.475(d) by adding that each ICF/IID's training and testing program must be based on the ICF/IID's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 483.475(d)(1)(iv) to replace the phrase “Ensure that staff can demonstrate knowledge” to “Demonstrate staff knowledge.”
• Revising § 483.475(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 483.475(d)(2)(ii) to allow an ICF/IIDs to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 483.475(e) to allow a separately certified ICF/IID within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

L. Emergency Preparedness Regulations for Home Health Agencies (HHAs) (§ 484.22)

Under the authority of sections 1861(m), 1861(o), and 1891 of the Act, the Secretary has established in regulations the requirements that a home health agency (HHA) must meet to participate in the Medicare program. Home health services are covered for qualifying elderly and people with disabilities who are beneficiaries under the Hospital Insurance (Part A) and Supplemental Medical Insurance (Part B) benefits of the Medicare program. These services include skilled nursing care, physical, occupational, and speech therapy, medical social work and home health aide services which must be furnished by, or under arrangement with, an HHA that participates in the Medicare program and must be provided in the beneficiary's home. As of June 2016, there were 12,335 HHAs participating in the Medicare program. The majority of HHAs are for-profit, privately owned agencies. There are no existing emergency preparedness requirements in the HHA Medicare regulations at part 484, subparts B and C.

We proposed to add emergency preparedness requirements at § 484.22, under which HHAs would be required to comply with some of the requirements that we proposed for hospitals. We proposed additional requirements under the HHA policies and procedures that would apply only to HHAs to address the unique circumstances under which HHAs provide services.

Specifically, we proposed at § 484.22(b)(1) that an HHA have policies and procedures that include plans for its patients during a natural or man-made disaster. We proposed that the HHA include individual emergency preparedness plans for each patient as part of the comprehensive patient assessment at § 484.55.

At § 484.22(b)(2), we proposed to require that an HHA to have policies and procedures to inform federal, state and local emergency preparedness officials about HHA patients in need of evacuation from their residences at any time due to an emergency situation based on the patient's medical and psychiatric condition and home environment. Such policies and procedures must be in accord with the HIPAA Privacy Rule, as appropriate.

We did not propose to require that HHAs meet all of the same requirements that we proposed for hospitals. Since HHAs provide healthcare services only in patients' homes, we did not propose requirements for policies and procedures to meet subsistence needs (§ 482.15(b)(1)); safe evacuation (§ 482.15(b)(3)); or a means to shelter in place (§ 482.15(b)(4)). We would not expect an HHA to be responsible for sheltering HHA patients in their homes or sheltering staff at an HHA's main or branch offices. We did not propose to require that HHAs comply with the proposed hospital requirement at § 482.15(b)(8) regarding the provision of care and treatment at alternate care sites identified by the local health department and emergency management officials. With respect to communication, we did not propose requirements for HHAs to have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510 as we propose for hospitals at § 482.15(c)(5). We have also modified the proposed requirement for hospitals at § 482.15(c)(7) by eliminating the reference to providing information regarding the facility's occupancy. The term occupancy usually refers to bed occupancy in an inpatient facility. Instead, at § 484.22(c)(6), we proposed to require HHAs to provide information about the HHA's needs and its ability to provide assistance to the local health department authority having jurisdiction or the Incident Command Center, or designee.

Comment: Several commenters stated that, despite our efforts, our proposed requirements for HHAs were not tailored for organizations that provide home-based services. Commenters indicated that we did not provide a complete description of our vision for the role that HHAs would play during and emergency and requested more clarity. A commenter requested that we work with the stakeholder community to develop a better understanding of how HHAs function, the needs of their patients, the communities in which they deliver services, and their resources.

Response: We appreciate the commenters' feedback. Many patients depend on the services of HHAs nationwide and the effective delivery of quality home health services is essential to the care of illnesses and prevention of hospitalizations. It is imperative that HHAs have processes in place to address the safety of patients and staff and the continued provision of services in the event of a disaster or emergency. We do not envision that HHAs will perform roles outside of their capabilities during an emergency. In addition, some HHAs that have agreements with hospitals already assist hospitals when at surge capacity. Home care professionals also have first-hand experience working in non-structured care environments. This experience has proven to be helpful in situations where patients are trapped in their homes or housed in shelters during a disaster or emergency. We also believe that because HHAs provide home care, they have first-hand knowledge of medically compromised individuals who have the potential to be trapped in their homes and unable to seek safe shelter during an emergency. This information is invaluable to state and local emergency preparedness officials. All of these activities and resources that HHAs have are necessary for effective community emergency preparedness planning.

We understand that one approach may not work for some and that community involvement will depend on the specific needs and resources of the community. However, we believe that establishing these emergency preparedness requirements for HHAs, and the other provider and suppliers, encourages collaboration and coordination that allows for a consistent, yet flexible regulatory framework across provider and supplier types. We would expect that HHAs will be proactive in their role of collaborating in community emergency preparedness planning efforts on both the national and local level. Through these efforts we believe that stakeholders will gain the opportunities to educate and define their role in state and local emergency planning.

Comment: Many commenters from an advocacy organization for HHAs agreed with the requirement that HHAs have policies and procedures that include individual emergency preparedness plans for each patient as part of the comprehensive patient assessment. However, several commenters requested clarification regarding our proposal. Commenters indicated that often times, during an emergency, a home care patient or their family may make different decisions and evacuate the patient, which largely negates any benefit from individualized plans. Commenters stated that HHAs should be required to instead provide planning materials to each patient upon assessment to assist them with developing a personal emergency plan. Some commenters indicated that patients should develop their own emergency plans based on their unique circumstances and requiring home health nurses to prepare emergency plans for their patients falls outside the scope of their practice. Most of the commenters supported the inclusion of a requirement for home health patients to have a personal emergency plan, but noted that CMS should keep in mind that the individual plans are only a starting place to locate and serve patients and may not be applicable to every type of emergency. A commenter suggested that we not link the identification of the patients' needs during an emergency to the patient assessment, but rather require that it occur within the first two weeks after the start of care to allow for staff to ensure the patient's acute care needs are met and remain first priority. In addition, some commenters recommended that each HHA be required to provide new patients and their families with a copy of the HHA's emergency policy and to inform them of the requirement that each new patient receive an individual emergency service plan. They also recommended providing a copy of the HHA's policies to the long-term care ombudsman programs that are involved in home healthcare.

Response: We appreciate the comments that we received on this issue. As a result of the comments, we agree that further clarification is needed. We also agree that all patients, their families and caregivers should be provided with information regarding the HHA's emergency plan and appropriate contact information in the event of an emergency. We did not intend for HHAs to develop extensive emergency preparedness plans with their patients. We proposed that HHAs include individual emergency preparedness plans for each patient as part of the comprehensive patient assessment required at § 484.55. Specifically, current regulations at § 484.55 require that each patient must receive, and an HHA must provide, a patient-specific, comprehensive assessment that accurately reflects the patient's current health status. In addition, regulations at § 484.55(a)(1) require that a registered nurse must conduct an initial assessment visit to determine the immediate care and support needs of the patient. As such, we believe that HHAs are already conducting and developing patient specific assessments and during these assessments, we expect that it will be minimally burdensome for HHAs to instruct their staff to assess the patient's needs in the event of an emergency.

We expect that HHAs already assist their patients with knowing what to do in the event of an emergency and the possibility that they may need to provide self-care if agency personnel are not available. For example, discussions to develop the individualized emergency preparedness plans could include potential disasters that the patient may face within the home such as fire hazards, flooding, and tornados; and how to contact local emergency officials. Discussions may also include education on steps that can be taken to increase the patient's safety. The individualized plan would be the written answers and solutions as a result of these discussions and could be as simple as a detailed emergency card developed with the patient. As commenters have indicated that often time patients choose to negate their plans and evacuate, we would expect that HHAs would use the individualized emergency plan to instruct patients on agency notification protocols for patients that relocate during an emergency and provide patients with information about the HHAs emergency procedures. HHAs could also use the individualized emergency plan to identify out of state contacts for each patient if available. HHA personnel should document that these discussions occurred. We are not requiring that HHAs provide their emergency plan and policies to any long-term care ombudsman programs, but we would encourage cooperation between various agencies.

Comment: Several commenters stated that HHAs and hospices have not been included in community emergency preparedness planning initiatives, nor have they received additional emergency planning funding. The commenters therefore requested additional time and flexibility to comply with the requirements for a communication plan. A few commenters requested clarification on what a communication plan for HHAs would entail.

Response: We understand the commenters' concerns about HHA providers' inclusion in community emergency preparedness planning initiatives. We believe that an emergency preparedness plan will better prepare HHA providers in case of an emergency or disaster and help to facilitate communication between facilities and community emergency preparedness agencies.

In response to the request for additional time, we have set the implementation date of these requirements for 1 year following the effective date of this final rule to allow facilities time to prepare. We also refer readers to the many resources that have been referenced in the proposed and final rules for guidance on developing an emergency preparedness communication plan for HHAs. HHAs are also encouraged to collaborate and participate in their local healthcare coalition that will be able to help inform and enable them to better understand how other providers are implementing the rules as well as provide access to local health department and emergency management officials that participate in local healthcare coalitions.

Comment: A few commenters expressed concern about the proposal to require that HHAs develop arrangements with other HHAs and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to HHA patients. Commenters stated that it was unclear how a home-based patient is “received” by a similar entity. The commenters noted that because most home health is provided in the home of the patient, care can be suspended for a period of time. Commenters also indicated that home health patients are not transferred to other HHAs. A commenter also stated that home health patients should not be transferred to hospitals during an emergency. A home health patient could receive care at other care settings, including those set up through emergency management and other state and federal government agencies. The commenters requested that CMS take these accommodations into consideration when deciding whether to finalize this proposal.

Response: We agree with the commenters. We understand that most HHAs would not necessarily transfer patients to other HHAs during an emergency and, based on this understanding of the nature of HHAs, we believe that HHAs should not be required to establish arrangements with other HHAs to transfer and receive patients during an emergency. Therefore, we are not finalizing the proposed requirement at § 484.22(b)(6) and (c)(1)(iv). During an emergency, if a patient requires care that is beyond the capabilities of the HHA, we would expect that care of the patient would be rearranged or suspended for a period of time. However, we note that as required at § 484.22(b)(2), HHAs will be responsible to have procedures to inform State and local emergency preparedness officials about HHA patients in need of evacuation from their residences at any time due to an emergency situation, based on the patient's medical and psychiatric condition and home environment.

Comment: A commenter indicated that it was unrealistic for HHAs to ensure cooperation and collaboration of various levels of government entities. The commenter noted that while it is critical that HHAs seek inclusion in discussions and understand the emergency planning efforts in their area, it has proven difficult for HHAs to secure inclusion. The commenter requested that we eliminate the requirement for HHAs to include a process for ensuring cooperation and collaboration with various levels of government.

Response: We recognize that some aspects of collaborating with various levels of government entities may be beyond the control of the HHA. In general, we used the word “ensure” or “ensuring” to convey that each provider and supplier will be held accountable for complying with the requirements in this rule. However, to avoid any ambiguity, we have removed the term “ensure” and “ensuring” from the regulation text of all providers and suppliers and have addressed the requirements in a more direct manner. Therefore, we are finalizing this proposal to require that HHAs include in their emergency plan a process for cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials. As proposed, we also indicate that HHAs must include documentation of their efforts to contact such officials and, when applicable, of its participation in collaborative and cooperative planning efforts.

Comment: A few commenters requested further clarification in regards to our use of the term “volunteers” as it relates to HHAs. Commenters noted that HHAs are not required to use volunteers and that the role of volunteers is not addressed at all in § 484.113.

Response: We provided information on the use of volunteers in the proposed rule (78 FR 79097), specifically with reference to the Medical Reserve Corps and the ESAR-VHP programs. Private citizens or medical professionals not employed by a facility often offer their voluntary services to providers during an emergency or disaster event. Therefore, we believe that HHAs should have policies and procedures in place to address the use of volunteers in an emergency, among other emergency staffing strategies. We believe such policies should address, among other things, the process and role for integration of state or federally-designated healthcare professionals, in order to address surge needs during an emergency. As with previous emergencies, facilities may choose to utilize assistance from the MRC or they may choose volunteers through the federal ESAR-VHP program. However, we want to emphasis that the need and use of volunteers or both is left up to the discretion of each individual facility, unless indicated as otherwise in their individual regulations.

Comment: A commenter stated that HHA and hospice providers should receive classification as essential healthcare personnel to gain access to restricted areas, in order to integrate into community-wide emergency communication systems.

Response: We have no authority to declare HHA and hospice providers as essential healthcare personnel in their local emergency management groups. We suggest that facilities who would like to gain access to restricted areas discuss how they may obtain access to community-wide emergency communication systems with their state and local government emergency preparedness agencies.

Comment: A commenter expressed concern about the level of technology required for HHAs and hospices to implement the emergency preparedness requirements. The commenter stated that this technology is expensive and not readily available. The commenter also noted that many HHA and hospice providers provide services in rural areas where cell phone coverage is limited. The commenter also stated that it is dangerous for the staff of HHAs and hospices located in urban areas to carry smart phone technology. The commenter finally noted that few HHA and hospice agencies provide staff with smart or satellite phones.

Response: As we discussed previously in this final rule, we are not endorsing a specific alternate communication system nor are we requiring the use of certain specific devices because of the associated burden and the potential obsolescence of such devices. However, we expect that facilities would consider using alternate means to communicate with staff and federal, state, tribal, regional and local emergency management agencies. Facilities can choose to utilize the technology suggested in this rule or they can use other types of backup communication. For example, if an HHA provider has nurses that work in a rural area without cell phone coverage, we would expect that the HHA agency would have some other means of communicating with the nurse, should an emergency or disaster occur. These means do not necessarily have to require sophisticated technology, although the devices discussed previously are proven useful communication technology. HHA providers are only required to provide, in their communication plan, plans for primary and alternate means for communicating with their staff and emergency management agencies. Facilities are given the discretion to choose what approach works for their specific circumstance.

Comment: In general, most commenters supported the proposed standards requiring a HHA to have training and testing programs, but suggested some revisions. A commenter stated that we did not provide a direct link between the testing requirements and the other requirements proposed for HHAs.

Response: We thank the commenters for their support of our proposed training and testing requirements. We believe that the emergency plan and policies and procedures cannot be executed without the proper training of staff members to ensure they have an understanding of the procedures and testing to demonstrate its feasibility and effectiveness.

Comment: We received a few comments on our proposal to require HHAs to provide annual training to their staff. A commenter stated that a requirement for annual training in emergency preparedness is an outdated approach to ensuring the organization is ready to put its plan into effect should the need arise. The commenter recommended that we revise the requirement by emphasizing the need for HHAs to involve staff in testing and other activities that will reinforce understanding of policies, procedures and their role in the implementation of the emergency plan. Another commenter stated that ongoing annual training is unnecessary and duplicative. The commenter suggested that we require only initial emergency preparedness training upon hire. Once this initial training is completed, copies of the plans and procedures would be kept on hand and readily accessible in the event of an emergency. The commenter stated that this approach would ensure just as timely and effective a response to an emergency as annual education while requiring less training time of staff taking away from patient care.

Response: We thank the commenters for their comments and appreciate their recommendations. The requirement for annual training is a standard requirement of many Medicare CoPs. We believe that the requirement is not outdated and is necessary to ensure that staff is regularly updated on their agency's emergency preparedness procedures. In our proposed training and testing standards, we stated that we would require a HHA to provide training in their emergency preparedness procedures to all new and existing staff. We also stated that a HHA must ensure that staff can demonstrate knowledge of their agency's emergency procedures. The emergency preparedness plan should be more than a set of written instructions that is referred to in an emergency. Rather, it should consist of policies and procedures that are incorporated into the facility's daily operations so that it is prepared to respond effectively during a disaster. Regular training and testing will ensure consistent staff behavior during an emergency, and also help to identify and correct gaps in the plan. In addition, we believe that requiring annual training is consistent with the proposed requirement to annually update a HHAs emergency plan and policies and procedures. We believe that it is best practice for facilities to ensure that their staff is regularly informed and educated in order to be the most prepared during an emergency situation.

Comment: A few commenters expressed their concern in regard to our proposal to require HHAs to participate in a community mock disaster drill. The commenters acknowledged the benefits and necessity of participating in drills and exercises to determine the effectiveness of an agency's plan, but stated that conducting drills and exercises is costly, time consuming, and especially difficult for HHAs in remote areas. Taking into consideration all of the documentation required for HHA patients, multiple commenters requested additional flexibility for HHAs, indicating that requiring both an annual tabletop exercise and a community drill is outside of the capacity of many agencies, would disrupt and compromise patient care, and requested additional flexibility for HHAs. A commenter suggested that HHAs be encouraged, rather than required, to participate in a community disaster drill. Another commenter stated that HHAs in particular would need to employ an additional person to be responsible for exercise planning and preparation and would also need to stop providing patient care during the exercises. The commenter indicated that there is a more cost effective and efficient way to ensure a HHA and its staff understand their emergency procedures without taking away from patient care and adding cost. The commenter suggested that, for HHAs, we should require “discussion-based” exercises leading up to a community mock drill required every 5 years.

Response: We appreciate the feedback from these commenters. As discussed, many other providers and suppliers have shared similar concerns. Therefore, we have revised § 484.22 to provide that HHAs may choose which type of training exercise they want to conduct in order to fulfill their second testing requirement. In addition, we would encourage agencies to continue looking to their local county and state governments and local healthcare coalitions for opportunities to collaborate on their training and testing efforts, such as a community full-scale exercise.

After consideration of the comments we received on these proposals, and the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for HHAs with the following modifications:

• Revising the introductory text of § 484.22 by adding the term “local” to clarify that HHAs must also comply with local emergency preparedness requirements.
• Revising § 484.22(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 484.22(b)(3) to require that in the event that there is an interruption in services during or due to an emergency, HHAs must have policies in place for following up with patients to determine services that are still needed. In addition, they must inform State and local officials of any on-duty staff or patients that they are unable to contact.
• Revising § 484.22(b)(4) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Removing § 484.22(b)(6) that required that HHAs develop arrangements with other HHAs and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to HHA patients.
• Revising § 484.22(c) by adding the term “local” to clarify that the HHA must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 484.22(c)(1) to remove the requirement that HHAs include the names and contact information for “Other HHAs” in the communication plan.
• Revising § 484.22(d) by adding that each HHA's training and testing program must be based on the HHA's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 484.22(d)(1)(ii) by replacing the phrase “Ensure that staff can demonstrate knowledge” to “Demonstrate staff knowledge.”
• Revising § 484.22(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 484.22(d)(2)(ii) to allow a HHA to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 484.22(e) to allow a separately certified HHA within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

M. Emergency Preparedness Regulations for Comprehensive Outpatient Rehabilitation Facilities (CORFs) (§ 485.68)

Section 1861(cc) of the Act defines the term “comprehensive outpatient rehabilitation facility” (CORF) and lists the requirements that a CORF must meet to be eligible for Medicare participation. By definition, a CORF is a non-residential facility that is established and operated exclusively for the purpose of providing diagnostic, therapeutic, and restorative services to outpatients for the rehabilitation of injured, sick, and persons with disabilities, at a single fixed location, by or under the supervision of a physician. As of June 2016, there were 205 Medicare-certified CORFs in the U.S.

Section 1861(cc)(2)(J) of the Act also states that the CORF must meet other requirements that the Secretary finds necessary in the interest of the health and safety of a CORF's patients. Under this authority, the Secretary has established in regulations, at part 485, subpart B, requirements that a CORF must meet to participate in the Medicare program.

Currently, § 485.64 “Conditions of Participation: Disaster Procedures ” includes emergency preparedness requirements CORFs must meet. The regulations state that the CORF must have written policies and procedures that specifically define the handling of patients, personnel, records, and the public during disasters. The regulation requires that all personnel be knowledgeable with respect to these procedures, be trained in their application, and be assigned specific responsibilities.

Currently, § 485.64(a) requires a CORF to have a written disaster plan that is developed and maintained with the assistance of qualified fire, safety, and other appropriate experts. The other elements under § 485.64(a) require that CORFs have: (1) Procedures for prompt transfer of casualties and records; (2) procedures for notifying community emergency personnel; (3) instructions regarding the location and use of alarm systems and signals and firefighting equipment; and (4) specification of evacuation routes and procedures for leaving the facility.

Currently, § 485.64(b) requires each CORF to: (1) Provide ongoing training and drills for all personnel associated with the CORF in all aspects of disaster preparedness; and (2) orient and assign specific responsibilities regarding the facility's disaster plan to all new personnel within 2 weeks of their first workday.

We proposed that CORFs comply with the same requirements that would be required for hospitals, with appropriate exceptions.

Specifically, at § 485.68(a)(5), we proposed that CORFs develop and maintain the emergency preparedness plan with assistance from fire, safety, and other appropriate experts. We did not propose to require CORFs to provide basic subsistence needs for staff and patients as we proposed for hospitals at § 482.15(b)(1). Because CORFs are outpatient facilities, we did not propose that CORFs have a system to track the location of staff and patients under the CORF's care both during and after the emergency as we propose to require for hospitals at § 482.15(b)(2). At § 485.68(b)(1), we proposed to require that CORFs have policies and procedures for evacuation from the CORF, including staff responsibilities and needs of the patients.

We did not propose that CORFS have arrangements with other CORFs or other providers and suppliers to receive patients in the event of limitations or cessation of operations. Finally, we did not propose to require CORFs to comply with the proposed hospital requirement at § 482.15(b)(8) regarding alternate care sites identified by emergency management officials.

With respect to communication, we would not require CORFs to comply with a proposed requirement similar to that for hospitals at § 482.15(c)(5) that would require a hospital to have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510, although we are clarifying in this final rule that CORFs must establish communications plans that are in compliance with federal laws, including the HIPAA rules. In addition, CORFs would not be required to comply with the proposed requirement at § 482.15(c)(6), which would state that a hospital must have a means of providing information about the general condition and location of patients as permitted under 45 CFR 164.510(b)(4).

We proposed including in the CORF emergency preparedness provisions a requirement for CORFs to have a method for sharing information and medical documentation for patients under the CORF's care with other healthcare facilities, as necessary, to ensure continuity of care (see proposed § 485.68(c)(4)). At § 485.68(c)(5), we proposed to require CORFs to have a communication plan that include a means of providing information about the CORF's needs and its ability to provide assistance to the local health department or authority having jurisdiction or the Incident Command Center, or designee. We did not propose to require CORFs to provide information regarding their occupancy, as we propose for hospitals, since the term occupancy usually refers to bed occupancy in an inpatient facility.

We proposed to remove § 485.64 and incorporate certain requirements into § 485.68. This existing requirement at § 485.64(b)(2) would be relocated to proposed § 485.68(d)(1).

Currently, § 485.64 requires a CORF to develop and maintain its disaster plan with assistance from fire, safety, and other appropriate experts. We incorporated this requirement at proposed § 485.68(a)(5). Currently, § 485.64(a)(3) requires that the training program include instruction in the location and use of alarm systems and signals and firefighting equipment. We incorporated these requirements at proposed § 485.68(d)(1).

We did not receive any comments that specifically addressed the proposed rule as it relates to CORFs. However, after consideration of the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule, we are finalizing the proposed emergency preparedness requirements for CORFs with the following modifications:

• Revising the introductory text of § 485.68, by adding the term “local” to clarify that CORFs must also comply with local emergency preparedness requirements.
• Revising § 485.68(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 485.68(b)(3) to replace the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Revising § 485.68(c), by adding the term “local” to clarify that the CORFs must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 485.68(d) by adding that each CORF's training and testing program must be based on the CORF's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 485.68(d)(1)(iv) to replace the phrase “Ensure that staff can demonstrate knowledge” to “Demonstrate staff knowledge.”
• Revising § 485.68(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 485.68(d)(2)(ii) to allow a CORF to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 485.68(e) to allow a separately certified CORF within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

N. Emergency Preparedness Regulations for Critical Access Hospitals (CAHs) (§ 485.625)

Sections 1820 and 1861(mm) of the Act provide that critical access hospitals participating in Medicare and Medicaid meet certain specified requirements. We have implemented these provisions in 42 CFR part 485, subpart F, Conditions of Participation for Critical Access Hospitals (CAHs). As of June 2016, there are 1,337 CAHs that must meet the CAH CoPs and 121 CAHs with psychiatric or rehabilitation distinct part units (DPUs). DPUs within CAHs must meet the hospital CoPs in order to receive payment for services provided to Medicare or Medicaid patients in the DPU.

CAHs are small, rural, limited-service facilities with low patient volume. The intent of designating facilities as “critical access hospitals” is to ensure access to inpatient hospital services and outpatient services, including emergency services, that meet the needs of the community.

If no patients are present, CAHs are not required to have onsite clinical staff 24 hours a day. However, a doctor of medicine or osteopathy, nurse practitioner, clinical nurse specialist, or physician assistant is available to furnish patient care services at all times the CAH operates. In addition, there must be a registered nurse, licensed practical nurse, or clinical nurse specialist on duty whenever the CAH has one or more inpatients. In the event of an emergency, existing requirements state there must be a doctor of medicine or osteopathy, a physician assistant, a nurse practitioner, or a clinical nurse specialist, with training or experience in emergency care, on call and immediately available by telephone or radio contact and available onsite within 30 minutes on a 24-hour basis or, under certain circumstances for CAHs that meet certain criteria, within 60 minutes. CAHs currently are required to coordinate with emergency response systems in the area to establish procedures under which a doctor of medicine or osteopathy is immediately available by telephone or radio contact on a 24-hours a day basis to receive emergency calls, provide information on treatment of emergency patients, and refer patients to the CAH or other appropriate locations for treatment.

CAHs are required at existing § 485.623(c), “Standard: Emergency procedures,” to assure the safety of patients in non-medical emergencies by training staff in handling emergencies, including prompt reporting of fires; extinguishing of fires; protection and, where necessary, evacuation of patients, personnel, and guests; and cooperation with firefighting and disaster authorities. CAHs must provide for emergency power and lighting in the emergency room and for battery lamps and flashlights in other areas; provide for fuel and water supply; and take other appropriate measures that are consistent with the particular conditions of the area in which the CAH is located. Since CAHs are required to provide emergency services on a 24-hour a day basis, they must keep equipment, supplies, and medication used to treat emergency cases readily available.

We proposed to remove the current standard at § 485.623(c) and relocate these requirements into the appropriate sections of a new CoP entitled, “Condition of Participation: Emergency Preparedness” at § 485.625, which would include the same requirements that we propose for hospitals.

We proposed to relocate current § 485.623(c)(1) to proposed § 485.625(d)(1). We proposed to incorporate current § 485.623(c)(2) into § 485.625(b)(1). Current § 485.623(c)(3) would be included in proposed § 485.625(b)(1). Current § 485.623(c)(4) would be reflected by the use of the term “all-hazards” in proposed § 485.625(a)(1). Section 485.623(d) would be redesignated as § 485.623(c).

Also, as discussed in section II.A.4 of the of this final rule we proposed at § 485.625(e)(1)(i) that CAHs must store emergency fuel and associated equipment and systems as required by the 2000 edition of the Life Safety Code (LSC) of the NFPA®. In addition to the emergency power system inspection and testing requirements found in NFPA® 99 and NFPA® 110 and NFPA® 101, we proposed that CAHs test their emergency and stand-by-power systems for a minimum of 4 continuous hours every 12 months at 100 percent of the power load the CAH anticipates it will require during an emergency.

Comment: A few commenters stated that since CAHs play an important role in rural communities, an immediate community response in the event of an emergency is critical.

Response: We agree with the commenters and we require CAHs, and all providers, to comply with all applicable federal, state, and local emergency preparedness requirements. We also encourage CAHs to participate in state-wide collaborations where possible.

Comment: A couple of commenters questioned the ability of CAHs to participate in an integrated health system to develop an emergency plan. They stated that providers and suppliers were encouraged throughout the proposed rule to plan together and with their communities to achieve coordinated responses to emergencies.

Response: As discussed previously in this rule, we agree that CAHs should be able to participate in an in integrated health system to develop a universal plan that encompasses one community-based risk assessment, separate facility-based risk assessments, integrated policies and procedures that meet the requirements for each facility, and coordinated communication plans, training and testing. Currently, a CAH that is a member of a rural health network has an agreement with at least one hospital in the network for patient referrals and transfers. The proposed requirement for a CAH's emergency preparedness communication plan states that the CAH must include contact information for other CAHs. However, to be consistent with an integrated approach, we have also changed the proposed requirements at § 485.625(c)(1)(iv) to state that CAHs should develop a communication plan that would require them to have contact information for other CAHs and hospitals or both.

We also received a number of comments pertaining to the proposed requirements for CAHs, most commenters addressing both hospitals and CAHs in their responses. Thus, we responded to the comments under the hospital section (section II.C. of this final rule). After consideration of the comments we received on the proposed rule, as discussed in section II.C of this final rule, we are finalizing the proposed emergency preparedness requirements for CAHs with the following:

• Revising the introductory text of § 485.625 by adding the term “local” to clarify that CAHs must also comply with local emergency preparedness requirements.
• Revising § 485.625(a)(4) by deleting the term “ensuring” and replacing the term “ensure with “maintain.”
• Adding at § 485.625(b)(1)(i) that CAHs must have policies and procedures that address the need to sustain pharmaceuticals during an emergency.
• Revising § 485.625(b)(2) to remove the requirement for CAHs to track on-duty staff and patients after an emergency and clarifying that in the event staff and patients are relocated, the CAH must document the specific name and location of the receiving facility or other location to which on-duty staff and patients were relocated to during an emergency.
• Revising § 485.625(b)(5) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records;” also revising paragraph (b)(7) to change the term “ensure” to “maintain”
• Revising § 485.625(c) by adding the term “local” to clarify that the CAHs must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 485.625(c)(1)(iv) by adding the phrase “and hospitals” to clarify that a CAH's communication plan must include contact information for other CAHs and hospitals in the area.
• Revising § 485.625(c)(5) to clarify that CAHs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 485.625(d) by adding that each CAH's training and testing program must be based on the CAH's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 485.625(d)(1)(iv) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising § 485.625(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 485.625(d)(2)(ii) to allow a CAH to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Revising § 485.625(e)(1) and (2) by removing the requirement for additional generator testing.
• Revising § 485.625(e)(2)(i) by removing the requirement for an additional 4 hours of generator testing and clarify that these facilities must meet the requirements of NFPA® 99 2012 edition, NFPA® 101 2012 edition, and NFPA® 110, 2010 edition.
• Revising § 485.625(e)(3) by removing the requirement that CAHs maintain fuel onsite and clarify that CAHs must have a plan to maintain operations unless the CAH evacuates.
• Adding § 485.625(f) to allow a separately certified CAH within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.
• Adding § 485.625(g) to incorporate by reference the requirements of 2012 NFPA® 99, 2012 NFPA® 101, and 2010 NFPA® 110.

O. Emergency Preparedness Regulation for Clinics, Rehabilitation Agencies, and Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services (§ 485.727)

Under the authority of section 1861(p) of the Act, the Secretary has established CoPs that clinics, rehabilitation agencies, and public health agencies must meet when they provide outpatient physical therapy (OPT) and speech-language pathology (SLP) services. The CoPs are set forth at part 485, subpart H.

Section 1861(p) of the Act describes “outpatient physical therapy services” to mean physical therapy services furnished by a provider of services, a clinic, rehabilitation agency, or a public health agency, or by others under an arrangement with, and under the supervision of, such provider, clinic, rehabilitation agency, or public health agency to an individual as an outpatient. The patient must be under the care of a physician.

The term “outpatient physical therapy services” also includes physical therapy services furnished to an individual by a physical therapist (in the physical therapist's office or the patient's home) who meets licensing and other standards prescribed by the Secretary in regulations, other than under arrangement with and under the supervision of a provider of services, clinic, rehabilitation agency, or public health agency, if the furnishing of such services meets such conditions relating to health and safety as the Secretary may find necessary. The term also includes SLP services furnished by a provider of services, a clinic, rehabilitation agency, or by a public health agency, or by others under an arrangement.

As of June 2016, there are 2,135 clinics, rehabilitation agencies, and public health agencies that provide outpatient physical therapy and speech-language pathology services. In the remainder of this proposed rule and throughout the requirements, we use the term “Organizations” instead of “clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services” for consistency with current regulatory language.

We believe these Organizations comply with a provision similar to our proposed requirement for hospitals at § 482.15(c)(7), which states that a communication plan must include a means of providing information about the hospital's occupancy, needs, and its ability to provide assistance, to the local health department and emergency management authority having jurisdiction, or the Incident Command Center, or designee. At § 485.727(c)(5), we proposed to require that these Organizations have a communication plan that include a means of providing information about their needs and their ability to provide assistance to the authority having jurisdiction (local and state agencies) or the Incident Command Center, or designee. We did not propose to require these Organizations to provide information regarding their occupancy, as we proposed for hospitals, since the term “occupancy” usually refers to bed occupancy in an inpatient facility.

The current regulations at § 485.727, “Disaster preparedness,” require these Organizations to have a disaster plan. The plan must be periodically rehearsed, with procedures to be followed in the event of an internal or external disaster and for the care of casualties (patients and personnel) arising from a disaster. Additionally, current § 485.727(a) requires that the facility have a plan in operation with procedures to be followed in the event of fire, explosion, or other disaster. Those requirements are addressed throughout the proposed CoP, and we did not propose including the specific language in our proposed rule.

However, existing § 485.727(a) also requires that the plan be developed and maintained with the assistance of qualified fire, safety, and other appropriate experts. Because this existing requirement is specific to existing disaster preparedness requirements for these organizations, we relocated the language to proposed § 485.727(a)(6).

Existing requirements at § 485.727(a) also state that the disaster plan must include: (1) Transfer of casualties and records; (2) the location and use of alarm systems and signals; (3) methods of containing fire; (4) notification of appropriate persons, and (5) evacuation routes and procedures. Because transfer of casualties and records, notification of appropriate persons, and evacuation routes are addressed under policies and procedures in our proposed language, we do not propose to relocate these requirements. However, because the requirements for location and use of alarm systems and signals and methods of containing fire are specific for these organizations, we proposed to relocate these requirements to § 485.727(a)(4).

Currently, § 485.727(b) specifies requirements for staff training and drills. This requirement states that all employees must be trained, as part of their employment orientation, in all aspects of preparedness for any disaster. This disaster program must include orientation and ongoing training and drills for all personnel in all procedures so that each employee promptly and correctly carries out his or her assigned role in case of a disaster. Because these requirements are addressed in proposed § 485.727(d), we did not propose to relocate them but merely to address them in that paragraph. Current § 485.727, “Disaster preparedness,” would be removed.

We did not receive any comments that specifically addressed the proposed rule as it relates to clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services. However, after consideration of the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule, we are finalizing the proposed emergency preparedness requirements for these Organizations with the following modifications:

• Revising the introductory text of § 485.727 by adding the term “local” to clarify that the Organizations must also comply with local emergency preparedness requirements.
• Revising § 485.727(a)(5) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 485.727(b)(3) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Revising § 485.727(c), by adding the term “local” to clarify that the Organizations must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 485.727(d) by adding that the Organization's training and testing program must be based on the organization's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 485.727(d)(1)(iv) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising § 485.727(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 485.727(d)(2)(ii) to allow an Organization to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 485.727(e) to allow a separately certified Organizations within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

P. Emergency Preparedness Regulations for Community Mental Health Centers (CMHCs) (§ 485.920)

A community mental health center (CMHC), as defined in section 1861(ff)(3)(B) of the Act, is an entity that meets applicable licensing or certification requirements in the state in which it is located and provides the set of services specified in section 1913(c)(1) of the Public Health Service Act. Section 4162 of Public Law 101-508 (OBRA 1990), which amended section 1861(ff)(3)(A) and 1832(a)(2)(J) of the Act, includes CMHCs as entities that are authorized to provide partial hospitalization services under Part B of the Medicare program, effective for services provided on or after October 1, 1991. Section 1866(e)(2) of the Act and 42 CFR 489.2(c)(2) recognize CMHCs as providers of services for purposes of provider agreement requirements but only with respect to providing partial hospitalization services. In 2015 there were 362 Medicare-certified CMHCs.

We proposed that CMHCs meet the same emergency preparedness requirements we proposed for hospitals, with a few exceptions. At § 485.920(c)(7), we proposed to require CMHCs to have a communication plan that include a means of providing information about the CMHCs' needs and their ability to provide assistance to the local health department or emergency management authority having jurisdiction or the Incident Command Center, or designee.

We did not receive any comments that specifically addressed the proposed rule as it relates to CMHCs. However, after consideration of the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for CMHCs with the following modifications:

• Revising the introductory text of § 485.920 by adding the term “local” to clarify that CMHCs must also comply with local emergency preparedness requirements.
• Revising § 485.920(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 485.920(b)(1) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered clients. We have also revised paragraph (b)(1) to provide that if on-duty staff and sheltered clients are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 485.920(b)(4) and (6) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.” Also, we made changes in paragraph (b)(6) to replace the term “ensure” to “maintain.”
• Revising § 485.920(c) by adding the term “local” to clarify that CMHCs must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 485.920(c)(5) to clarify that CMHCs must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 485.920(d) by adding that each CMHC's training and testing program must be based on the CMHC's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 485.920(d)(1) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising § 485.920(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 485.920(d)(2)(ii) to allow a CMHC to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 485.920(e) to allow a separately certified CMHC within a healthcare system to elect to be a part of the healthcare systems emergency preparedness program.

Q. Emergency Preparedness Regulations for Organ Procurement Organizations (OPOs) (§ 486.360)

Section 1138(b) of the Act and 42 CFR part 486, subpart G, establish that OPOs must be certified by the Secretary as meeting the requirements to be an OPO and designated by the Secretary for a specific donation service area (DSA). The current OPO CfCs do not contain any emergency preparedness requirements. As of June 2016, there were 58 Medicare-certified OPOs that are responsible for identifying potential organ donors in hospitals, assessing their suitability for donation, obtaining consent from next-of-kin, managing potential donors to maintain organ viability, coordinating recovery of organs, and arranging for transport of organs to transplant centers. Our proposed requirements for OPOs to develop and maintain an emergency preparedness plan, were similar to those proposed for hospitals, with some exceptions.

Since potential donors are located within hospitals, at proposed § 486.360(a)(3), instead of addressing the patient population as proposed for hospitals at § 482.15(a)(3), we proposed that the OPO address the type of hospitals with which the OPO has agreements; the type of services the OPO has the capacity to provide in an emergency; and continuity of operations, including delegations of authority and succession plans.

We proposed only 2 requirements for OPOs at § 486.360(b): (1) A system to track the location of staff during and after an emergency; and (2) a system of medical documentation that preserves potential and actual donor information, protects confidentiality of potential and actual donor information, and ensures records are secure and readily available.

In addition, at § 486.360(c), we proposed only three requirements for an OPO's communication plan. An OPO's communication plan would be required to include: (1) Names and contact information for staff; entities providing services under arrangement; volunteers; other OPOs; and transplant and donor hospitals in the OPO's DSA; (2) contact information for federal, state, tribal, regional, or local health department and emergency preparedness staff and other sources of assistance; and (3) primary and alternate means for communicating with the OPO's staff, federal, state, tribal, regional, or local emergency management agencies. Unlike the requirement we proposed for hospitals at § 482.15(d)(2)(i) and (iii), we proposed at § 486.360(d)(2)(i) that an OPO be required only to conduct a tabletop exercise.

Finally, at § 486.360(e), we proposed that each OPO have agreement(s) with one or more other OPOs to provide essential organ procurement services to all or a portion of the OPO's DSA in the event that the OPO cannot provide such services due to an emergency. We also proposed that the OPO include within its agreements with hospitals required under § 486.322(a) and in the protocols with transplant programs required under § 486.344(d), the duties and responsibilities of the hospital, transplant program, and the OPO in the event of an emergency.

Comment: We proposed the OPOs should track their staff during and after an emergency. All of the comments we received regarding this requirement were supportive. Commenters requested that we clarify whether an electronic system will satisfy this requirement. Commenters indicated that many OPOs currently have a means to communicate with all staff electronically and request that they respond with their location (within an identified time period) if necessary. Commenters questioned whether this process would be sufficient to meet this requirement.

Response: We appreciate the commenters' feedback and agree that the means of communication described by commenters is sufficient to meet this requirement. However, we want to emphasize that this is not the only way OPOs may choose to meet this requirement. In the proposed rule, we indicated that OPOs have the flexibility to determine how best to track staff whether an electronic database, hard copy documentation, or some other method.

Comment: A few commenters agreed with the proposal that would require that communication plans include names and contact information for staff, entities providing services under arrangement, volunteers, other OPOs, and transplant and donor hospitals in the OPO's DSA. However, the commenters requested that CMS narrow the requirements for OPOs to include only individuals or entities providing services under arrangement to those entities that would provide services in or during an emergency situation, such as emergency contacts for building services (plumbing, electrical, etc.), transportation providers, laboratory testing, etc.

Another commenter also agreed with the importance of providing a communication plan with staff information, but disagreed with the requirement that all entities providing services under arrangement with an OPO should be contacted during an emergency. The commenter recommended that only vendors providing critical services be contacted.

Response: We are requiring that OPOs provide in their communication plan the names and contact information for staff, entities providing services under arrangement, volunteers, other OPOs, and transplant and donor hospitals in the OPO's DSA. We are also requiring that OPOs include the contact information for federal, state, tribal, regional, and local emergency preparedness staff. Facilities can choose to include the contact information of other entities in their communication plan; however, we are not narrowing the scope of our requirements in this section to only include those entities with which an OPO has an arrangement. We continue to believe that it is important that OPOs have contact information for all of the previously specified entities because the OPO cannot know before an emergency what entities or services it would need. Also, we do not believe that it is burdensome for OPOs to maintain contact information for these entities because we believe that maintenance of contact information for these various entities is part of the normal course of business.

Comment: Several commenters requested clarification on whether existing databases of contact information would satisfy the communication plan requirements. The commenters listed examples such as a hosted volunteer tracking system or UNOS' DonorNET, with external backups.

Response: Each OPO should develop and maintain its own separate contact list in order to satisfy the communication plan requirements. OPOs must include contact information for staff, entities providing services under arrangement, volunteers, other OPOs, transplant and donor hospitals in the OPO's DSA and federal, state, tribal, regional, and local emergency preparedness staff, and other sources of assistance. DonorNET and other hosted volunteer tracking systems may contain useful contact information that OPO providers can use during an emergency, but these systems do not replace the need for comprehensive contact lists in the provider's emergency preparedness communication plan.

Comment: In regard to our proposed requirements for OPOs to have training and testing programs, all the commenters agreed with our proposals, but requested clarification of the phrase “consistent with their expected roles.” The commenters questioned whether this meant that an OPO is not required to perform emergency preparedness training to staff, vendors, and volunteers who are not expected to play a role in the OPOs emergency response.

Response: This final rule requires that all persons (those employed, contracted, or volunteering) who provide some service within an OPO must be trained on the OPOs emergency preparedness procedures, given that an emergency can take place at any time. All providers and suppliers types have the flexibility to determine the level of training that is need for each staff person. As the requirement states for OPOs, this level of training should be determined consistent with the persons expected role during an emergency. It does not eliminate the need for all persons to be trained; however, an OPO has the discretion to determine to what extent.

Comment: Most of the commenters did not agree with the proposed requirement that each OPO have an agreement with one or more other OPOs. These commenters stated that the requirement was unnecessary and too burdensome. They indicated that our estimate of 13 burden hours was extremely conservative and that possibly as many as 200 contracts would need to be modified to comply with the requirements in proposed § 486.360(e).

Response: We agree with the commenters. The majority of the commenters indicated that complying with this requirement would require much more than the estimated 13 burden hours. In reviewing their comments and our estimate, we believe that the requirement for an agreement with one or more OPOs should be modified. Based upon our analysis and comments submitted in response to the proposed rule, we have inserted alternate ways in which an OPO could plan to continue its operations. See § 486.360(e). See section III.O. of this final rule Collection of Information Requirements, ICRs Regarding Condition for Coverage: Emergency Preparedness (§ 486.360), for our current burden estimate.

We disagree with the commenters that the requirement for OPOs to have an agreement with another OPO is unnecessary. We believe each OPO should be prepared to continue its operations or at least those activities it deems essential during an emergency as required by § 486.360(e). However, as discussed later in this final rule, based on the comments we received, we have decided to provide alternate ways in which OPOs could satisfy this requirement, which are discussed as follows:

Comment: A commenter noted the difficulty in developing an emergency plan based upon the all-hazards approach. One OPO works with more than 170 hospitals. Each hospital had its own specific levels of service and donor potential. These hospitals also had different geographically-based hazards. All of these factors would need to be addressed or taken into account when developing an emergency program.

Response: The amount of resources that each OPO must expend to comply with the requirements in this final rule will vary depending upon many factors. The number of hospitals the OPO works with, the services that each hospital offers, and the geographical hazards for each of these hospitals are all factors that could affect how complex the emergency plan and program would need to be. And, all of these various factors would need to be addressed in the OPO's emergency plan. We realize developing emergency plans and programs can be challenging; however, since OPOs are already working with these hospitals and there are a wide-range of emergency planning tools available, as well as assistance from the OPTN and other organizations, we believe that OPOs will be able to develop their emergency preparedness plans and programs within the burden estimates we have developed.

Comment: As discussed earlier with transplant centers, several commenters expressed concerned about how the proposed OPO requirements could interfere with or even contradict OPTN policies on emergencies; the commenter specifically referenced OPTN 1.4 that addresses regional and national emergencies. Among other things, this policy requires OPTN members to notify the OPTN concerning any alternative arrangements of care during an emergency and provide additional information as needed to allow for clinical information to be properly accessed and shared with all parties involved in a donation or transplant event.

Response: We disagree with the commenters. We do not expect any OPO to violate any of the OPTN's policies. However, as stated earlier, the OPTN's policies are not comprehensive. For example, they do not cover local emergencies or the other specific requirement in this final rule, that is, requirements for a risk assessment using an all-hazards approach, an emergency plan, specific policies and procedures, a communication plan, and training and testing. In addition, as described earlier, including emergency preparedness requirements in the OPO CfCs provides us with oversight and enforcement authority we do not have for the OPTN policies. In addition, we do not believe that complying with any of the requirements in this final rule will result in any conflict with the OPTN's requirements.

Comment: Some commenters questioned whether OPOs that already had more than one location or office needed to have an agreement with another OPO to provide essential organ procurement services to all or a portion of their DSA in the event of an emergency. A commenter questioned if we had considered this as an alternative to the proposed agreement.

Response: We did not propose having multiple locations as an alternative to the proposed requirement to have an agreement with another OPO. However, as the commenters suggested, we do believe that having more than one location could certainly satisfy our concern that OPOs have the capability to continue their organ procurement responsibilities in the event of an emergency. Therefore, in finalizing this requirement, we have added two alternatives to the requirement for an OPO to have an agreement with another OPO (§ 486.360(e)). For OPOs with multiple locations, the OPO could satisfy this requirement if it had an alternate location within its DSA from which it could continue its operation during an emergency. Another alternative is if the OPO had a plan to relocate to an alternate location that is part of its emergency plan as required in § 486.360(a). If the emergency were to affect an area larger than the OPO's DSA, we would expect that the OPTN would assist the OPO (OPTN Policy 4.1).

Comment: Some commenters suggested that instead of having formal agreements, OPOs, transplant centers, and hospitals should be required to develop mutually agreed-upon protocols that address each facility's responsibilities during an emergency.

Response: We agree with the commenters. After reviewing the comments we received on the proposed transplant center and OPO emergency preparedness requirements, we believe that the best way to ensure that transplant centers, the hospitals in which they operate, and the OPOs are prepared for emergencies is to require the development of mutually agreed-upon protocols that address the hospital, transplant center, and OPO's duties and responsibilities during an emergency. Therefore, we have removed the requirements in proposed § 482.78(a), which required an agreement with at least one Medicare-approved transplant center, and § 482.78(b), which required that the transplant center ensure that the written agreement required under § 482.100 addresses the duties and responsibilities of the hospital and OPO during an emergency. Instead, we have finalized a requirement at § 486.360(e) that OPOs develop mutually-agreed upon protocols that address the duties and responsibilities of the hospital, transplant center, and OPO during emergencies. We are also requiring that transplant centers and the hospitals in which they operate develop mutually-agreed upon protocols. Therefore, all 3 facilities will need to work together to develop and maintain protocols that address emergency preparedness.

Comment: A commenter recommended that CMS revise language in the manual to cover the costs of transportation of brain-dead donors for organ procurement. Furthermore, the commenter recommended that transplant centers be permitted to record organs from brain-dead donors sent to OPO recovery centers in the ratio of Medicare usable organs to total organs on their costs reports. The commenter noted that this would facilitate implementation of the proposed emergency preparedness requirements.

Response: We believe it is extremely unlikely that brain-dead donors would need to be transported during an emergency. Most OPOs are not recovering brain-dead donors every day and might or might not choose to move a potential donor depending upon the donor's condition. However, we would encourage transplant centers, the hospitals in which they are located, and OPOs to address this possibility in their emergency preparedness protocols as finalized in this rule. In addition, the commenter's request involves changes to the state operations manual and Medicare's policy on cost reports. These are payment policy issues and are outside of the scope of this regulation.

After consideration of the comments we received on these provisions, and the general comments we received on the proposed rule, as discussed in the hospital section (section II.C. of this final rule, we are finalizing the proposed emergency preparedness requirements for OPOs with the following modifications:

• Revising the introductory text of § 486.360 by adding the term “local” to clarify that OPOs must also comply with local emergency preparedness requirements.
• Revising § 486.360(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 486.360(b)(1) by clarifying that tracking during and after the emergency applies to on-duty staff and any staff that are relocated during an emergency. Also, we revised paragraph (b)(1) to provide that if on-duty staff are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• Revising § 486.360(b)(2) to change the phrase “ensures records are secure and readily available” to secures and maintains availability of records.”
• Revising § 486.360(c) by adding the term “local” to clarify that the OPO must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 486.360(d) by adding that each OPO's training and testing program must be based on the OPO's emergency plan, risk assessment using an all hazards approach, policies and procedures, and communication plan.
• Revising § 486.360(d)(1)(iv) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising the requirement in § 486.360(e) to require the development and maintenance of emergency preparedness protocols that are mutually agreed upon by the transplant center, hospital, and OPO.
• Revising § 486.360(e) to state that OPOs can satisfy the agreement requirement by having at least one other location from which they could operate from within their DSA or a plan to set up an alternate location during an emergency as part of its emergency plan as required by § 486.360(a).
• Adding § 486.360(f) to allow a separately certified OPO within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

R. Emergency Preparedness Regulations for Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) (§ 491.12)

As of June 2016, there were a combined total of 11,500 RHCs and FQHCs. Section 1861(aa) of the Act sets forth the rural health clinic (RHC) and federally qualified health center (FQHC) services covered by the Medicare and Medicaid program. RHCs must be located in an area that is both a rural area and a designated shortage area.

Conditions for Certification for RHCs and Conditions for Coverage for FQHCs are found at 42 CFR part 491, subpart A. Current emergency preparedness requirements are found at § 491.6(c).

We proposed that the RHCs' and FQHCs' emergency preparedness plans address the type of services the facility has the capacity to provide in an emergency.

Although RHCs and FQHCs currently do not have specific requirements for emergency preparedness, they have requirements for “Emergency Procedures” found at § 491.6, under “Physical plant and environment.” At § 491.6(c)(1), the RHC or FQHC must train staff in handling non-medical emergencies. This requirement would be addressed at proposed § 491.12(d)(1). At § 491.6(c)(2), the RHC or FQHC must place exit signs in appropriate locations. This requirement would be incorporated into our proposed requirement at § 491.12(b)(1), which would require RHCs and FQHCs to have policies and procedures for safe evacuation from the facility which includes appropriate placement of exit signs. Finally, at § 491.6(c)(3), the RHC or FQHC must take other appropriate measures that are consistent with the particular conditions of the area in which the facility is located. This requirement would be addressed throughout the proposed CfC for RHCs and FQHCs, particularly proposed § 491.12(a)(1), which requires the RHCs and FQHCs to perform a risk assessment based on an “all-hazards” approach. Current § 491.6(c) would be removed.

We proposed emergency preparedness requirements based on the requirements that we proposed for hospitals, modified to address the specific characteristics of RHCs and FQHCs. We do not believe all of these requirements are appropriate for RHCs/FQHCs, which serve only outpatients. We did not propose to require RHC/FQHCs to provide basic subsistence needs for staff and patients. Also, unlike that proposed for hospitals at § 482.15(b)(2), we did not propose that RHCs/FQHCs have a system to track the location of staff and patients in the facility's care both during and after the emergency.

At § 482.15(b)(3), we proposed that hospitals have policies and procedures for safe evacuation from the hospital, which includes consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance. Therefore, at § 491.12(b)(1), we proposed to require that RHCs/FQHCs have policies and procedures for evacuation from the RHC/FQHC, including appropriate placement of exit signs, staff responsibilities, and needs of the patients.

Unlike the requirement that was proposed for hospitals at § 482.15(b)(7), we did not propose that RHCs/FQHCs have arrangements with other RHCs/FQHCs or other providers and suppliers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to RHC/FQHC patients. We did not propose to require RHC/FQHCs to comply with the proposed hospital requirement at § 482.15(b)(8) regarding alternate care sites.

In addition, we would not require RHCs/FQHCs to comply with the proposed requirement for hospitals found at § 482.15(c)(5), which would require that a hospital have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510. Modified from what has been proposed for hospitals at § 482.15(c)(7), at § 491.12(c)(5), we proposed to require RHCs/FCHCs to have a communication plan that would include a means of providing information about the RHCs/FQHCs needs and their ability to provide assistance to the local health department or emergency management authority having jurisdiction or the Incident Command Center, or designee. We did not propose to require RHCs/FQHCs to provide information regarding their occupancy, as we propose for hospitals, since the term occupancy usually refers to bed occupancy in an inpatient facility.

Comment: A commenter supported CMS' proposal to exempt FQHCs from releasing patient information as permitted under HIPAA 45 CFR part 164 in the case of an emergency or disaster.

Another commenter opposed CMS' proposed requirements for a communication plan for RHCs and FQHCs. The commenter stated their belief that RHCs and FQHCs should provide some level of patient clinical information during a disaster. The commenter noted the importance of sharing patient information with other hospitals that may be receiving evacuated patients during an emergency or a disaster. Furthermore, the commenter noted that these records should be available online through an EMR or through another procedure for providing patient information.

Response: We appreciate the commenter's support. We continue to believe that RHCs and FQHCs should not be required to comply with the proposed requirement for hospitals, which would require that a hospital have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510. RHCs and FQHCs are not inpatient facilities that would transfer patients to another facility during an evacuation. Because they operate on an outpatient basis, whereby during an emergency the facility would close and cancel appointments, we do not believe that it is necessary for RHCs and FQHCs to be mandated to provide patient information during an evacuation. However, we note that RHCs and FQHCs are not precluded from including policies and procedures in their communication plan to share patient information during an emergency with other facilities. RHCs and FQHCs can include these policies and procedures if they believe it is appropriate for their facility.

Comment: A commenter stated that small facilities such as an FQHC or RHC should be exempt from conducting a risk assessment. Another commenter stated that clinics should be required to have a plan to utilize volunteers in an emergency.

Response: We disagree with removing the risk assessment requirement for FQHCs and RHC. As we have stated earlier in this document, conducting a risk assessment is essential to developing an emergency preparedness plan. Clinics will have the flexibility to include volunteers in their emergency plan as indicated by their individual risk assessments. We would expect RHCs and FQHCs to develop strategies for addressing emergency events identified by their risk assessments.

After consideration of the comments we received on these provisions, and the general comments we received on the proposed rule, as discussed previously and in the hospital section (section II.C. of this final rule, we are finalizing the proposed emergency preparedness requirements for RHCs and FQHCs with the following modifications:

• Revising the introductory text of § 491.12 by adding the term “local” to clarify that RHCs and FQHCs must also coordinate with local emergency preparedness requirements.
• Revising § 491.12(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 491.12(b)(3) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Revising § 491.12(c) by adding the term “local” to clarify that RHCs and FQHCs must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 491.12(d) by adding that a RHC and FQHC's training and testing program must be based on the RHC and FQHC's emergency plan, risk assessment, policies and procedures, and communication plan.
• Revising § 491.12(d)(1)(iv) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising § 491.12(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 491.12(d)(2)(ii) to allow a RHC and FQHC to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 491.12(e) to allow separately certified RHCs and FQHCs within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

S. Emergency Preparedness Regulation for End-Stage Renal Disease (ESRD) Facilities (§ 494.62)

Sections 1881(b), 1881(c), and 1881(f)(7) of the Act establish requirements for end-stage renal disease (ESRD) facilities. ESRD is a kidney impairment that is irreversible and permanent and requires either a regular course of dialysis or kidney transplantation to maintain life. Dialysis is the process of cleaning the blood and removing excess fluid artificially with special equipment when the kidneys have failed. As of June 2016, there were 6,648 Medicare-participating ESRD facilities in the U.S.

We addressed emergency preparedness requirements for ESRD facilities in the April 15, 2008 final rule (73 FR 20370) titled, “Conditions for Coverage for End-Stage Renal Disease Facilities; Final Rule.” Emergency preparedness requirements are located at § 494.60(d), Condition: Physical environment, Standard: Emergency preparedness. We proposed to relocate these existing requirements to proposed § 494.62, Emergency preparedness.

Current regulations include the requirement that dialysis facilities be organized into ESRD Network areas. Our regulations describe these networks at § 405.2110 as CMS-designated ESRD Networks in which the approved ESRD facilities collectively provide the necessary care for ESRD patients. The ESRD Networks have an important role in an ESRD facility's response to emergencies, as they often arrange for alternate dialysis locations for patients and provide information and resources during emergency situations. As noted earlier, we do not propose incorporating the ESRD Network requirements into this proposed rule. We did not propose to require ESRD facilities to provide basic subsistence needs for staff and patients, whether they evacuate or shelter in place, including food, water, and medical supplies; alternate sources of energy to maintain temperatures to protect patient health and safety and for the safe and sanitary storage of provisions; emergency lighting; and fire detection, extinguishing, and alarm systems; and sewage and waste disposal as we proposed for hospitals at § 482.15(b)(1).

At § 494.62(b), we proposed to require facilities to address in their policies and procedures, fire, equipment or power failures, care-related emergencies, water supply interruption, and natural disasters in the facility's geographic area.

At § 482.15(b)(3), we proposed that hospitals have policies and procedures for the safe evacuation from the hospital, which includes consideration of care and treatment needs of evacuees; staff responsibilities; transportation; identification of evacuation location(s); and primary and alternate means of communication with external sources of assistance. We do not believe all of these requirements are appropriate for ESRD facilities, which serve only outpatients. Therefore, at § 494.62(b)(2), we proposed to require that ESRD facilities have policies and procedures for evacuation from the facility, including staff responsibilities and needs of the patients.

At § 494.62(b)(6), we proposed to require ESRD facilities to develop arrangements with other dialysis facilities or other providers and suppliers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to dialysis facility patients. At § 494.62(c)(7), dialysis facilities would be required to comply with the proposed requirement for hospitals at § 482.15(c)(7), with one exception. At § 494.62(c)(7), we proposed to require dialysis facilities to have a communication plan that include a means of providing information about their needs and their ability to provide assistance to the authority having jurisdiction or the Incident Command Center, or designee. We did not propose to require dialysis facilities to provide information regarding their occupancy, as we proposed for hospitals, since the term occupancy usually refers to bed occupancy in an inpatient facility.

At § 494.62(d)(1)(i), we proposed to require ESRD facilities to ensure that staff can demonstrate knowledge of various emergency procedures, including: informing patients of what to do; where to go, including instructions for occasions when the geographic area of the dialysis facility must be evacuated; and whom to contact if an emergency occurs while the patient is not in the dialysis facility.

We proposed to relocate existing requirements for patient training from § 494.60(d)(2) to proposed § 494.62(d)(3), patient orientation. In addition, the facility would have to ensure that, at a minimum, patient care staff maintained current CPR certification and ensure that nursing staff were properly trained in the use of emergency equipment and emergency drugs.

We proposed to redesignate current § 494.60(d). Current requirements for emergency plans at § 494.60 were captured within proposed § 494.62(a). Current language that defines an emergency for dialysis facilities found at § 494.60(d) would be incorporated into proposed § 494.62(b). We proposed to relocate existing requirements for emergency equipment and emergency drugs found at existing § 494.60(d)(3) to § 494.62(b)(9). We proposed to relocate the existing requirement at § 494.60(d)(4)(i) that requires the facility to have a plan to obtain emergency medical system assistance when needed to proposed § 494.62(b)(8). We proposed to relocate the current requirements at § 494.60(d)(4)(iii) for contacting the local health department and emergency preparedness agency at least annually to ensure that the agency is aware of dialysis facility's needs in the event of an emergency to proposed § 494.62(a)(4). We also proposed to redesignate the current § 494.60(e) as § 494.60(d).

Comment: Some commenters agreed with the proposal to require ESRD providers to develop and maintain an emergency preparedness communication plan. Several commenters disagreed with the implementation of the emergency preparedness communication plan requirements for dialysis facilities. A commenter noted that the current CfCs require dialysis facilities to have at least annual contact with the local disaster management agency.

A commenter agreed with the proposal that exempts ESRD facilities from having to provide information regarding occupancy since, according to the commenter, the facilities do not serve outpatient and do not routinely accommodate overnight stays.

Response: We appreciate the commenters' support. We continue to believe that ESRD facilities should develop and maintain a communication plan so that the facility can be prepared to communicate with the local health department, emergency management and other emergency preparedness officials during an emergency or a disaster. We are not requiring dialysis facilities to provide information regarding their occupancy, as we are requiring for hospitals, since the term occupancy refers to bed occupancy in an inpatient facility.

Comment: A commenter stated that the language used in this section was vague and erroneously technical. This commenter specifically noted that the term “community mock disaster drill” in § 494.62(d)(2)(i) was not consistent with the terminology used in the document, Homeland Security Exercise and Evaluation Program Terminology, Methodology, and Compliance Guidelines (HSEEP). The term “Incident Command Center” in § 494.62(c)(7) is not an Incident Command System (ICS) or National Incident Management System (NIMS) term.

Response: We understand that the commenter is concerned with this rule's inconsistencies with terminology used in the disaster and emergency response planning community. Providers and suppliers use various terms to refer to the same function and we have used the term “Incident Command Center” in this rule to mean “Operations Center” or “Incident Command Post.” After this final rule is published, interpretive guidance will be published by CMS that will provide additional clarification.

Comment: A few commenters indicated their support for requiring ESRD facilities to develop training and testing programs. The commenters stated that given the often medically fragile population that ESRD facilities serve and the risk of service disruption during an emergency, it would be beneficial for these facilities to train their staff and educate their patients regarding steps they can take to prepare themselves for emergency situations. A commenter expressed support while also reiterating that existing requirements for ESRD facilities require staff to be trained in emergency procedures. A commenter also expressed their support for allowing ESRD facilities to initiate a facility based mock drill in the absence of a community drill since participation in a community disaster drill has been difficult at times.

Response: We thank these commenters for their support and agree that emergency preparedness training and testing will benefit not only the staff of the ESRD facilities, but will also have a positive impact on the patients that they serve. We also encourage ESRD facilities to be proactive on preparing for emergencies. For example, it is essential that dialysis patients and their caregivers have all of their essential documentation, such as their doctor's orders or scripts, medical history, etc.

Comment: A commenter noted that with advance notice many dialysis patients can evacuate and find shelter with families and friends. However, they many have difficulty getting to another dialysis facility due to problems with transportation. The commenter did acknowledge that providing or arranging for transportation is beyond the scope of individual dialysis facilities, but they believed it should be addressed at a regional level.

Response: We agree with the commenter that transportation may be a problem for some dialysis patients that need to evacuate and that arranging for transportation in other areas is beyond the scope of responsibility for individual dialysis facilities. However, these facilities are required to provide emergency preparedness patient training, which includes instructions on what to do if the geographic area in which the dialysis facility is located must be evacuated (§ 494.62(d)(3)). We expect that instructions on who to contact for assistance would be included in that training.

Comment: Some commenters questioned our proposed requirement for policies and procedures that address having a process by which the staff could confirm that emergency equipment, including emergency drugs, were on the premises at all times and immediately available (§ 494.62(b)(9)). A commenter stated that this requirement concerns clinical practice policies that are outside the purview of emergency preparedness. They noted that while the needs of an individual patient in an emergency may require that the facility enact it emergency response plans, that the needs of an individual patient would not require the activation of the facility's emergency preparedness plan. Another commenter questioned if we would be providing a list of emergency drugs and specifying the quantities of those drugs that the dialysis facility would be expected to have at their facility.

Response: We disagree with commenter on this requirement being beyond the scope of this regulation. We are not attempting to regulate clinical practice. This section only requires that the staff have a process to ensure that emergency equipment is on the premises and available during an emergency. While we have listed some basic emergency equipment that should be available during any care-related emergency, it is the facility's responsibility to determine what emergency equipment it needs to have available. In addition, dialysis facilities need to be able to manage care-related emergencies during an emergency when other assistance, such as EMTs and ambulances, may not be immediately available to them. This final rule does not contain any specific list of emergency drugs or specify any quantities of drugs to have at a facility. That is beyond the scope of this rule. After this rule is finalized, there may be additional sub-regulatory guidance concerning this requirement.

Comment: Some commenters requested clarification on the requirement about having policies and procedures that address the role of the dialysis facility under a waiver declared by the Secretary, in accordance with section 1135 of the Act, in the provision of care and treatment at an alternate care site identified by emergency management officials (§ 494.62(b)(7)). A commenter inquired about nurses using protocols and what was CMS guidance on this. Another commenter thought that the requirement was vague and stated that further guidance was needed. This commenter noted that providers may request waivers and that facilities were unlikely to have a policy beyond either the facility's statement that they would comply with the waiver or a procedure on how to request a waiver.

Response: We believe that these issues are more appropriately addressed in sub-regulatory guidance. After this final rule is published, further guidance will be provided on how facilities should comply with this requirement.

Comment: A commenter suggested revising our proposed requirement for dialysis facilities to have policies and procedures that address “(6) The development of arrangements with other dialysis facilities or other providers to receive patients in the event of limitations or cessation of operations to maintain the continuity of services to dialysis facility patients.” That commenter suggested modifying the language to read “multiple prearrangements with other dialysis facilities . . .”

Response: We disagree with the commenter. The proposed requirement uses the plural, “arrangements.” We believe that clearly indicates that dialysis facilities are expected to have more than one arrangement with other facilities to maintain continuity of services to their patients. Thus, we will be finalizing the requirement as proposed.

Comment: A commenter suggested that dialysis facilities, as well as other providers, have a requirement to use volunteer management registries. Another commenter was supportive of ESRD facilities using the Medical Reserve Corps (MRC) and the Emergency System for Advance Registration of Volunteer Health Professional (ESAR-VHP) as discussed in the hospital section of the proposed rule (78 FR 79097).

Response: We are finalizing the requirement that is set forth in § 494.62(b)(5) that dialysis facilities have policies and procedures that address the use of volunteers in an emergency or other emergency staffing strategies, including a process and role for integration of state and federally designated healthcare professionals to address surge needs during an emergency. We believe that each facility needs the flexibility to determine how they should use volunteers during an emergency. If the facility is located in a state where there is a volunteer registry, that is certainly a valuable resource for any healthcare facility and we would encourage the use of that registry. However, we do not believe that this should be a requirement in this final rule. We also agree with the other commenter and encourage dialysis facilities to utilize assistance from the MRC and ESAR-VHP.

Comment: Some commenters noted that we did not require dialysis facilities to provide basic subsistence needs for their staff and patients during an emergency. A commenter agreed with not requiring the provision of subsistence needs. However, another commenter requested clarification on why this was not a requirement for dialysis facilities and recommended requiring subsistence need for at least a short period of time.

Response: We continue to believe that it is not appropriate to require that dialysis facilities provide subsistence needs for either their staff or patients. Based on our experience with dialysis facilities, we expect that most facilities would discharge any patients in their facility as soon as possible if they are unable to provide services. Therefore, requiring subsistence needs should not be necessary. However, we want to emphasize that the requirements in this final rule are the minimum requirements that dialysis facilities must meet to participate in the Medicare program. Every facility must develop and maintain its own emergency plan based on its risk assessment as required by § 494.62(a). Based on their risk assessment, any dialysis facility could decide that it should provide subsistence needs and for what duration.

Comment: A commenter noted that implementing the requirement for a dialysis facility to track staff and patients during and after an emergency include routine calls with the Kidney Community Emergency Response (KCER). KCER is a part of the Network Coordinating Center (NCC) that works with all 18 of the ESRD networks. KCER is the leading authority on emergency preparedness and response for the ESRD Network community with leadership and management delegated to the KCER staff under authority and direction of CMS.

Response: We agree with the commenter that KCER is an essential resource for the ESRD community. We recommend that dialysis facilities utilize this resource in their emergency preparedness activities. However, we believe that any specific requirements concerning communications in the ESRD community should be established in sub-regulatory guidance.

Comment: Concerning our proposed requirement for dialysis facilities to have policies and procedures for a system to track the location of staff and patients in the dialysis facility's care both during and after the emergency, a commenter stated that it would be reasonable for CMS to propose specific technology standards to make compatibility with electronic medical records (EMR) systems a reality. The commenter noted that reliance on print records is tenuous at best and this is associated with quick onset of an emergency.

Response: We acknowledge that EMRs would be very helpful in transitions in care and in locating patients. However, the specific technology standards for an EMR system suggested by the commenter are beyond the scope of this final rule.

Comment: A commenter believed that there was a contradiction between the preamble language (“[w]e do not propose to require ESRD facilities to provide basic subsistence needs for staff and patients, whether they evacuate or shelter in place, including food, water and medical supplies . . . (78 FR 79116)) and the requirement in proposed § 494.62(b)(3). The proposed section required dialysis facilities to have policies and procedures that addressed a means to shelter in place for patients, staff, and volunteers who remain in the facility. The commenter recommended that we provide further clarity and guidance on what is expected in the rule.

Response: We apologize for any confusion. However, in the language cited by the commenter, we were stating that we were not proposing any requirement related to subsistence needs associated with evacuation or sheltering in place, not that we were not proposing a requirement for the dialysis facility to have policies and procedures that address sheltering in place. We are finalizing § 494.62(b)(3) as proposed.

Comment: A commenter disapproved of allowing a one-year exemption from the requirement for a full-scale exercise if the facility experienced an actual emergency that required activation of their emergency plan. The commenter noted that appropriate and frequent activation are key to an emergency management plan success and that early but unnecessary plan activation is better than a needed but future activation. The best training tool for familiarizing the leadership and staff in emergency procedures is through experiencing actual plan activation.

Response: We agree that emergency plans must be activated for staff and the leadership to both get experience with the emergency procedures and test the plan. For that reason, we are finalizing the requirements for training and testing the emergency plan. However, we also believe that any facility that has had to activate their plan due to an actual emergency meets the requirements in this final rule and requiring another full-scale drill would be burdensome. Therefore, we are finalizing the exemption contained in § 494.62(d)(2)(i) as proposed.

Comment: A commenter wanted more specificity concerning the federal law(s) that dialysis facilities would be required to comply with in accordance with proposed § 494.62(c). The commenter wanted us to specifically state the federal law(s) to which the dialysis facilities would need to comply.

Response: Federal laws, as well as state and local laws, can be modified by the appropriate legislative bodies and executives at any time. In addition, dialysis facilities are already required to comply with the applicable federal, state, and local laws and regulations that pertain to both their licensure and any other relevant health and safety requirements (§ 494.20). Since the requirements we are finalizing are in the dialysis facilities' CfC, these facilities must already comply with all of the applicable federal, state, and local law and regulation concerning their licensure and health and safety standards and are responsible for knowing those laws and regulations. Thus, we are finalizing § 494.62(c) as proposed.

Comment: A commenter noted that we, as well as other HHS documents, suggest utilizing healthcare coalitions and that more descriptive terminology would be necessary to indicated at what level facilities and the Networks should be expected to act with emergency management at all of those levels.

Response: Commenting on other HHS documents is beyond the scope of this final rule. We have encouraged the providers and suppliers covered by this final rule to form and work with healthcare coalitions or both. However, that would be their choice, it is not required. In addition, since coalitions may be organized in different ways, it would be difficult to provide specific requirements on how providers and suppliers are to interact with them. Therefore, we do not believe it is appropriate to provide specific guidance or requirements on how dialysis facilities are to interact with coalitions.

Comment: A commenter believed that dialysis facilities and the ESRD Networks should be provided funding for the equipment that would be needed to comply with the requirement for a communication plan (§ 494.62(c)). The commenter specifically proposed funding for cellular devices and satellite communications technology for the ESRD Networks and GETS/WPS to ensure communications between providers and emergency management resources providing direction during emergencies.

Response: This rule finalizes the emergency preparedness requirements for dialysis facilities in § 494.62 of the ESRD CfCs. Dialysis facilities must comply with all of their CfCs to be certified by Medicare and must do so within the payments they received from Medicare.

Comment: A commenter notes that the proposed rule allowed for an exemption from an exercise after plan activation (proposed § 494.62(d)(2)). They recommended that it would be necessary for at least one component of the emergency plan specify what action(s) constitute activation of the plan.

Response: We agree with the commenter. Although it is not a specifically required component of the emergency plan, we do believe that each plan should indicate under what circumstances it would be deemed to be activated.

Comment: A commenter stated that we had erroneously attributed some type of collective authority and emergency assistance ability to the ESRD Networks. These are administrative governing bodies and liaisons with the federal government. They stated that the increased responsibilities imposed on the dialysis facilities by this rule would result in confusion within the ESRD community.

Response: We understand the commenter's concerns. However, we will be providing further sub-regulatory guidance after publication of this final rule. The guidance should provide more specific guidance for the ESRD community on how to comply with the requirements in this final rule.

After consideration of the comments we received on these provisions, and the general comments we received on the proposed rule, as discussed earlier and in the hospital section (section II.C. of this final rule), we are finalizing the proposed emergency preparedness requirements for ESRD facilities with the following modifications:

• Revising the introductory text of § 494.62 by adding the term “local” to clarify that dialysis facilities must also comply with local emergency preparedness requirements.
• Revising § 494.62(a)(4) by deleting the term “ensuring” and replacing the term “ensure” with “maintain.”
• Revising § 494.62(b)(1) by clarifying that tracking during and after the emergency applies to on-duty staff and sheltered patients. We have also revised paragraph (b)(1) to provide that if on-duty staff and sheltered patients are relocated during the emergency, the dialysis facility must document the specific name and location of the receiving facility or other location.
• Revising § 494.62(b)(4) to change the phrase “ensures records are secure and readily available” to “secures and maintains availability of records.”
• Revising § 494.62(b)(6) to replace the term “ensure” with “maintain.”
• Revising § 494.62(b)(8) to delete the phrase “a process to ensure that” and replacing the term with “How.”
• Revising § 494.62(b)(9) to delete the phrase “ensuring that” and replacing it with the term “by which the staff can confirm.”
• Revising § 494.62(c), by adding the term “local” to clarify that the dialysis facility must develop and maintain an emergency preparedness communication plan that also complies with local laws.
• Revising § 494.510(c)(5) to clarify that the dialysis facility must develop a means, in the event of an evacuation, to release patient information, as permitted under 45 CFR 164.510(b)(1)(ii).
• Revising § 494.62(d) by adding that each dialysis facility's training and testing program must be based on the dialysis facility's emergency plan, risk assessment using an all hazards approach, policies and procedures, and communication plan.
• Revising § 494.62(d)(1)(iii) to replace the phrase “ensure that staff can demonstrate knowledge” to “demonstrate staff knowledge.”
• Revising § 494.62(d)(2)(i) by replacing the term “community mock disaster drill” with “full-scale exercise.”
• Revising § 494.62(d)(2)(ii) to allow a dialysis facility to choose the type of exercise it will conduct to meet the second annual testing requirement.
• Adding § 494.62(e) to allow a separately certified dialysis facilities within a healthcare system to elect to be a part of the healthcare system's emergency preparedness program.

III. Provisions of the Final Regulations

A. Changes Included in the Final Rule

In this final rule, we are adopting the provisions of the December 27, 2013 proposed rule (78 FR 79082) with the following revisions:

• For all provider and supplier types, we are making a technical revision to clarify that facilities must also coordinate with local emergency preparedness systems.
• For RNHCIs, inpatient hospices, CAHs, ASCs, and hospitals, we are removing the requirement for facilities to track all staff and patients after an emergency and clarifying that in the event on-duty staff and sheltered patients are relocated during an emergency, the provider/supplier must document the specific name and location of the receiving facility or other location for staff and patients who leave the facility during the emergency.
• For home based hospices and HHAs, we are removing the tracking requirement and requiring that in the event there is an interruption in services during or due to an emergency, the provider must have policies in place for following up with on-duty staff and patients to determine services that are still needed. In addition, they must inform state and local officials of any on-duty staff or patients that they are unable to contact.
• For ESRD facilities, CMHCs, LTC facilities, ICF/IIDs, PACE organizations, PRTFs, and OPOs we are clarifying that tracking during and after the emergency applies to on-duty staff and sheltered patients. We have also revised the regulations to provide that if on-duty staff and sheltered patients are relocated during the emergency, the facility must document the specific name and location of the receiving facility or other location.
• We did not propose a tracking requirement for CORFs, RHCs, FQHCs, transplant centers, and Organizations and have not made any revisions regarding tracking for these facilities in this final rule.
• For ASCs and HHAs, we are removing the requirement that ASCs and HHAs develop arrangements with other ASCs/HHAs and other providers to receive patients in the event of limitations or cessation of operations to ensure the continuity of services to patients.
• For ASCs and HHAs, we are removing the requirement that the communication plan include the names and contact information for other ASCs/HHAs.
• For all provider and supplier types, we are making a technical revision to clarify that facilities must develop and maintain an emergency preparedness communication plan that also complies with local law.
• For RNHCIs, ASCs, hospices, PRTFs, PACE organizations, hospitals, LTC facilities, ICF/IIDs, CAHs, CMHCs, and dialysis facilities, we are clarifying that these provider and supplier types must have a means, in the event of an evacuation, to release patient information as permitted under 45 CFR 164.510(b)(1)(ii).
• For all provider and supplier types with the exception of RNHCIs, OPOs, and transplant centers, we are revising testing requirements by replacing the term “community mock disaster drill” with “full-scale exercise.”
• For ASCs only, we are removing the requirement for participation in a community-based testing exercise and revising the requirement to only require ASCs to conduct an individual, facility-based full scale testing exercise.
• For all provider and supplier types with the exception of RNHCIs, OPOs, and transplant centers, we are revising testing requirements to allow each facility to choose the type of exercise they must conduct to meet the second annual testing requirement.
• For hospitals, CAHs, and LTC facilities, we are revising emergency and standby power system requirements by removing the requirement for an additional 4 hours of generator testing and clarifying that a facility must meet the requirements of NFPA® 99 2012 edition and NFPA® 110, 2010 edition.
• For hospitals, CAHs, and LTC facilities, we are revising emergency and standby power system requirements by removing the requirement that a facility must maintain fuel onsite and clarifying that facilities must have a plan to maintain operations unless the facility evacuates.
• For all provider and supplier types, we are adding a separate standard to the regulations text that will allow a separately certified healthcare facility within a healthcare system to elect to be a part of the healthcare systems unified emergency preparedness program.

B. Incorporation by Reference

In this final rule, we are incorporating by reference the NFPA 101® 2012 edition of the LSC, issued August 11, 2011, and all Tentative Interim Amendments issued prior to April 16, 2014; the NFPA 99® 2012 edition of the Health Care Facilities Code, issued August 11, 2011, and all Tentative Interim Amendments issued prior to April 16, 2014; and the NFPA 110 ® 2010 edition of the Standard for Emergency and Standby Power Systems(including Tentative Interim Amendments to chapter 7), issued August 6, 2009.

• NFPA® 99, Health Care Facilities Code, 2012 edition, issued August 11, 2011.

++ TIA 12-2 to NFPA® 99, issued August 11, 2011.

++ TIA 12-3 to NFPA® 99, issued August 9, 2012.

++ TIA 12-4 to NFPA® 99, issued March 7, 2013.

++ TIA 12-5 to NFPA® 99, issued August 1, 2013.

++ TIA 12-6 to NFPA® 99, issued March 3, 2014.

• NFPA® 101, Life Safety Code, 2012 edition, issued August 11, 2011;

++ TIA 12-1 to NFPA® 101, issued August 11, 2011.

++ TIA 12-2 to NFPA® 101, issued October 30, 2012.

++ TIA 12-3 to NFPA® 101, issued October 22, 2013.

++ TIA 12-4 to NFPA® 101, issued October 22, 2013.

• NFPA® 110, Standard for Emergency and Standby Power Systems, 2010 edition, including TIAs to chapter 7, issued August 6, 2009.

The materials that are incorporated by reference are reasonably available to interested parties and can be inspected at the CMS Information Resource Center, 7500 Security Boulevard, Baltimore, MD. Copies may be obtained from the National Fire Protection Association, 1 Batterymarch Park, Quincy, MA 02169, www.nfpa.org , 1.617.770.3000. If any changes in this edition of the Code are incorporated by reference, CMS will publish a document in the Federal Register to announce the changes.

The NFPA 101® 2012 edition of the LSC (including the TIAs) provides minimum requirements, with due regard to function, for the design, operation and maintenance of buildings and structures for safety to life from fire. Its provisions also aid life safety in similar emergencies.

The NFPA 99® 2012 edition of the Health Care Facilities Code (including the TIAs) provides minimum requirements for health care facilities for the installation, inspection, testing, maintenance, performance, and safe practices for facilities, material, equipment, and appliances, including other hazards associated with the primary hazards.

The NFPA 110® 2010 edition of the Standard for Emergency and Standby Power Systems (including the TIAs) provides minimum requirements for the installation, maintenance, operation, and testing requirements as they pertain to the performance of the emergency power supply system (EPSS).

IV. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to provide 30-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

We are soliciting public comment on each of these issues for the following sections of this document that contain information collection requirements (ICRs).

A. Factors Influencing ICR Burden Estimates

Please note that under this final rule, a hospital's ICRs will differ from the ICRs of other Medicare or Medicaid provider and supplier types. We have calculated the ICR for each provider and supplier separately and have included a chart summarizing the burden at the end of each section. A significant factor in the burden for each provider or supplier type will be whether the type of facility provides inpatient services, outpatient services, or both. Moreover, even where the regulatory requirements are the same, certain factors will greatly affect the burden for different providers and suppliers, such as the size and location of the provider or supplier, whether or not they participate in any type of network, and whether they already have a substantial emergency preparedness program.

We have determined that the development of an emergency plan is more labor intensive than conducting the risk assessment for a few reasons. In general, the risk assessment process requires following a checklist and/or filling out a table (see: https://asprtracie.hhs.gov/documents/tracie-evaluation-of-HVA-tools.pdf for a set of examples), whereas planning is a more comprehensive process that requires individual expertise, identifying mitigation options to problems, and documenting policies and procedures to mitigation potential challenges that may arise depending on the identified in their risk assessment. We also reference numerous resources in the preamble that are available for use by providers and suppliers to help develop their risk assessments. Also, in the final rule, we allow providers and suppliers who are part of integrated health systems to develop one risk assessment and we encourage them to work with their community health coalitions in doing so. As a result, we expect that it will take more time to complete the emergency plan in comparison to the amount of time it will take to conduct a risk assessment as the emergency plan must be unique to the specific facility to which it applies.

In each section, where possible, we provide information regarding the characteristics which drive burden for each provider and supplier type. Current Medicare or Medicaid regulations for some providers and suppliers include requirements similar to those in this regulation. For example, existing regulations for RNHCIs and dialysis facilities require both types of facilities to have written disaster plans that address emergencies (42 CFR 403.742(a)(4) and 42 CFR 494.60(d)(4), respectively).

We have determined that the time required to conduct an annual review and update of the emergency preparedness plan is dependent upon whether there are existing emergency preparedness requirements for the providers and suppliers. We believe that the providers and suppliers with existing emergency preparedness requirements have some sort of an emergency preparedness plan that is updated at least annually based on current standards of practice. For these providers and suppliers, no additional burden has been assigned for the annual review and update of the emergency preparedness plan. The following providers and suppliers currently have emergency preparedness requirements: RNCHIs, ASCs, PACE organizations, Hospitals, ICF/IIDs, HHAs, CORFs, CAHs, Organizations, RHCs, FQHCs, inpatient hospice, and ESRD facilities. For those providers and suppliers who do not have existing emergency preparedness requirements, we believe that it is less likely that there is an emergency preparedness plan that is reviewed and updated annually. For these providers and suppliers, we estimate that the time it takes to review and update the plan annually is equal to one-third of the amount of time it takes to develop their emergency preparedness plan. The following providers and suppliers currently do not have emergency preparedness requirements: CMHCs, OPOs, PRTFs and outpatient hospices.

Furthermore, some accrediting organizations (AOs) that have CMS-approved accreditation programs for Medicare providers and suppliers have emergency preparedness standards. Those organizations are: The Joint Commission (TJC), the American Osteopathic Association/Healthcare Facilities Accreditation Program (AOA/HFAP), the Accreditation Association for Ambulatory Health Care, Inc. (AAAHC), the American Association for Accreditation for Ambulatory Surgery Facilities, Inc. (AAAASF), and Det Norske Veritas (DNV) GL—Healthcare (DNV GL). Each of these AOs has deeming authority for different types of facilities; for example, TJC has comprehensive emergency preparedness requirements for hospitals. Thus, as noted in the hospital discussion later in this section, we anticipate that TJC-accredited hospitals will have a smaller burden associated with this final rule than many other providers or suppliers.

In addition, many facilities already have begun preparing for emergencies. According to a study by Niska and Burt, virtually all hospitals already have plans to respond to natural disasters (Niska and Shimizu I. “Hospital preparedness for emergency response: United States, 2008.” National Health Statistics Reports. (2011): 1-14).

Hospitals, as well as other healthcare providers, also receive grant funding for disaster or emergency preparedness from the federal and state governments, as well as other private and non-profit entities. However, we were unable to determine the amount of funding that has been granted to hospitals, the number of hospitals that received funding, or whether that funding will continue in a predictable manner. We also do not know how the hospitals spent this funding. Therefore, in determining the burden for this final rule, we did not take into account any funding a hospital or other healthcare provider might have received from sources other than Medicare or Medicaid.

B. Sources of Data Used in Estimates of Burden Hours and Cost Estimates

We obtained the data used in this discussion on the number of the various Medicare and Medicaid providers and suppliers from Medicare's Certification and Survey Provider Enhanced Reporting (CASPER) as of June 2016, unless indicated otherwise. We have not included data for healthcare facilities that are not Medicare or Medicaid certified.

Unless otherwise indicated, we obtained all salary information for the different positions identified in the following assessments from the May 2014 National Occupational Employment and Wage Estimates, United States by the Bureau of Labor Statistics at http://www.bls.gov/oes/current/oes_nat.htm . In the proposed rule we added a 30 percent increase for overhead and benefits. For the final rule, we have calculated the estimated hourly rates in this final rule based upon the national mean salary for that particular position to include a 100 percent increase for overhead and benefits. Where we were able to identify positions linked to specific providers or suppliers, we used that compensation information. However, in some instances, we used a general position description, such as director of nursing, or we used information for comparable positions. For example, we were not able to locate specific information for physicians who practice in hospices. However, since hospices provide palliative care, we used the compensation information for physicians who work in specialty hospitals.

Salary may be affected by the rural versus urban locations. For example, based on our experience with CAHs, they usually pay their administrators less than the mean hourly wage for Health Service Managers in general medical and surgical hospitals. Thus, we considered the impact of the rural nature of CAHs to estimate the hourly wage for CAH administrators and calculated total compensation by adding in an amount for fringe benefits. Many healthcare providers and suppliers could reduce their burden by partnering or collaborating with other facilities to develop their emergency management plans or programs. Due to a lack of data, we did not consider this in our burden estimates. In estimating the burden associated with this final rule, we took into consideration the many free or low cost emergency management resources healthcare facilities have available to them and assume that many providers will use only these resources in order to meet the requirements of this rule. If we feel an organization may hire a consultant or contractor, we have indicated such. Following is a list of some of the available resources:

Department of Health and Human Services (HHS), Office of the Assistant Secretary for Preparedness and Response (ASPR).

• http://asprtracie.hhs.gov/ Technical Resources, Assistance Center, and Information Exchange (TRACIE).
• http://www.phe.gov/about.

Health Resources and Services Administration-Emergency Preparedness and Continuity of Operations.

• http://www.hrsa.gov/emergency/.

Centers for Medicare and Medicaid Services (CMS).

• www.cms.hhs.gov/Emergency/.

Centers for Disease Control and Prevention—Emergency Preparedness & Response.

• www.emergency.cdc.gov.

Food and Drug Administration (FDA)—Emergency Preparedness and Response.

• http://www.fda.gov/EmergencyPreparedness/default.htm.

Substance Abuse and Mental Health Services Administration (SAMHSA)—Disaster Readiness and Response.

• http://www.samhsa.gov/Disaster/.

National Institute for Occupational Safety and Health (NIOSH)—Business Emergency Management Planning.

• www.cdc.gov/niosh/topics/emres/business.html.

Department of Labor (DOL), Occupational Safety and Health Administration (OSHA)—Emergency Preparedness and Response.

• www.osha.gov/SLTC/emergencypreparedness.

Federal Emergency Management Agency (FEMA)—State Offices and Agencies of Emergency Management—Contact Information.

• http://www.fema.gov/about/contact/statedr.shtm .
• http://www.fema.gov/plan-prepare-mitigate .

Department of Homeland Security (DHS).

• http://www.dhs.gv/training-technical-assistance .

Comment: Multiple commenters believe that we underestimated the amount of time and work it will take for many providers and suppliers to come into compliance with our proposed requirements. Specifically, some commenters expressed that we did not truly capture what updating policies and procedures will entail. The commenters explained that updating policies and procedure will go beyond having meetings, drafting revisions, and obtaining approvals. They expressed that updating policies and procedures would also involve researching alternatives, assessing costs that may be involved, reviewing potential changes with affected employees, implementing the changes, and training staff and testing outcomes.

Response: We appreciate the commenter's feedback and understand their concerns. As discussed earlier in the preamble, we recognize the level of work it will take for facilities to come into compliance with these requirements. While we understand that updating policies and procedures can involve many tasks and that for some facilities emergency preparedness requirements may be new. We believe that periodically reviewing and updating policies and procedures is a standard business practice for healthcare facilities since they must comply with applicable federal, state, and local laws, regulations, and ordinances that periodically change. Adding disaster related policies may be a new task for some, but the process of updating policies and procedures will not be a brand new burden. As part of an annual review and update, staff are required to be trained and be familiar with many policies and procedures in the operation of their facility and are held responsible for knowing these requirements. Annual reviews help to refresh these policies and procedures which would include any revisions to them based on the facility experiencing an emergency or as a result of a community or natural disaster. Basic contact information and procedures could be updated during an annual review. We would not expect that an annual review would be an extensive overhaul of their EP plan. Healthcare facilities routinely revise and update policies and operational procedures to ensure that they are operating based on best practices.

Therefore, we accounted for the staff time that will be involved to review and update current policies and procedures for alignment with these emergency preparedness requirements.

Comment: Some commenters believe that we incorrectly estimated the salaries of the staff involved in meeting the requirements. A commenter questioned whether CMS could use average wages by region for determining the salaries, rather than national average wages. The commenter believes that the wages used in the proposed rule were low for their area, therefore underestimating the estimates for conducting the risk assessment and developing the emergency plan.

Response: As indicated in the proposed rule, we obtained all salary information for the different positions identified in the following assessments from the National Occupational Employment and Wage Estimates, United States by the Bureau of Labor Statistics (BLS). We calculated the estimated hourly rates based upon the national mean salary for that particular position, including a 30 percent increase for overhead and benefits. In this final rule, we have updated the salary data as indicated by the BLS data. The final rule salaries include a 100 percent increase for overhead and benefits. Where we were able to identify positions linked to specific providers or suppliers, we used that compensation information. However, in some instances, we used a general position description, such as director of nursing, or we used information for comparable positions.

Comment: A commenter believes that we miscalculated the time and expense required in planning and carrying out a community-based drill. The commenter believes that while most unaccredited providers and suppliers probably would not be starting from scratch with regard to drills and exercises, our description of the tasks and burdens associated with organizing a drill is still insufficient. The commenter believes that we did not provide a thorough explanation of what the emergency drill process would actually entail. The commenter points out that planning would include tasks such as contacting other providers and community emergency response agencies, convening with this group on a regular basis, and writing the hospital's part of the exercise. They also suggest that participating in the drill would include recruiting volunteers, informing patients about the drill, and obtaining financial approval to conduct the drills. The commenter believes that given all of this, it could more realistically take six months to a year to plan and carry out a comprehensive emergency drill and urges CMS to revise our estimates to more accurately reflect the time and resources involved.

Response: The regulation would require some providers to participate in a community-based training exercise where available. We are not requiring facilities to plan and execute a community-wide exercise, only participate to the extent their facility would contribute in an emergency situation if the whole community/town is impacted. When a community-based exercise is not accessible, facilities would conduct a facility-based training. As the commenter pointed out, we did not provide prescriptive emergency exercises and drills. Instead, we provided resources that facilities can utilize in developing their drills and exercises. The time estimates we used to calculate the burden associated with conducting a drill for each provider and supplier were our best estimates for the activity. Our estimates serve as a baseline for the time it will take to implement the task, understanding that the actual time and task involved will vary for each individual facility based on the unique circumstances of each facility. We provided a time estimate for the activities that, at a minimum, each facility will have to take into consideration when conducting a community drill.

Comment: We received conflicting comments regarding the staff positions that will be involved in the activities of developing the emergency preparedness programs. For example, one commenter indicated that in addition to an administrator and director of nursing, a plant manager and food service manager will also need to be included in the process of developing the plan and conducting the risk assessment. Other commenters indicated that the majority of the burden associated with developing plans, updating policies and procedures, and facilitating/planning trainings and testing will fall on the administrator.

Response: Based upon our experience with the various providers and suppliers, we determined the staff positions that would likely be involved in complying with the varying requirements for the different providers and suppliers. The actual individuals who are involved in the activities needed to comply with the requirements in this final rule will vary based on the unique circumstances of each individual healthcare facility. Our estimates provide an overall idea of the necessary staff positions involved, but we note that ultimately the actual individuals involved will be determined by the individual facility. We have listed personnel that would address various components of the EP requirements in both the ICR and RIA sections of the rule.

C. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 403.748)

Section 403.748(a) will require RNHCIs to develop and maintain an emergency preparedness plan that must be reviewed and updated at least annually. We proposed that the plan must meet the requirements specified at § 403.748(a)(1) through (4). We will discuss the burden for these activities individually beginning with the risk assessment requirement in § 403.748(a)(1).

The current RNHCI CoPs already require RNHCIs to have a written disaster plan that addresses “loss of power, water, sewage, and other emergencies” (42 CFR 403.742(a)(4)). In addition, the CoPs also require RNHCIs to include measures to evaluate facility safety issues, including physical environment, in their quality assessment and performance improvement (QAPI) program (42 CFR 403.732(a)(1)(vi)). We expect that all RNHCIs have considered some of the risks likely to happen in their facility. However, we expect that all RNHCIs will need to review any existing risk assessment and perform the tasks necessary to ensure their assessment is documented and utilize a facility-based and community based all-hazards approach.

We have not designated any specific process or format for RNHCIs to use in conducting their risk assessment because we believe they need the flexibility to determine how best to accomplish this task. However, we expect that they will obtain input from all of their major departments in the process of developing their risk assessments.

Based on our experience with RNHCIs, we expect that complying with this requirement will require the involvement of an administrator, the director of nursing, and the head of maintenance. It is important to note that RNHCIs do not provide medical care to their patients. Depending upon the state in which they are located, RNHCIs may not be licensed and may not have licensed or certified staff. RNHCIs do not compensate their staff at the same level we have used to determine the burden for other healthcare providers and suppliers. Therefore, for the purpose of estimating the burden, we have used lower hourly wages for the RNHCI staff than for other providers and suppliers whose staff must comply with licensing and certification standards.

We expect that to perform a risk assessment, the RNHCI's administrator (2 hours), the director of nursing (5 hours), and the head of maintenance (2 hours) will attend an initial meeting; review relevant sections of the current risk assessment; prepare comments; attend a follow-up meeting; perform a final review, and approve the risk assessment. We expect that the director of nursing will coordinate the meetings, review and critique the current risk assessment, coordinate comments, develop the new risk assessment, and ensure that it is approved.

We estimate that it will require 9 burden hours for each RNHCI to complete the risk assessment at a cost of $366. There are 18 RNHCIs. Therefore, it will require an estimated 162 annual burden hours (9 burden hours for each RNHCI × 18 RNHCIs) for all 18 RNHCIs to comply with this requirement at a cost of $6,588 ($366 estimated cost for each RNHCI × 18 RNHCIs).

After conducting a risk assessment, RNHCIs will need to review, revise, and, if necessary, develop new sections for their emergency plans. The current RNHCI CoPs require RNHCIs to have a written disaster plan for emergencies (§ 403.742(a)(4)). However, based on our experience with RNHCIs, their plans likely will address only evacuation from their facilities. We expect that all RNHCIs will need to review, revise, and develop new sections for their plans.

We expect that the same individuals who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we expect that it will require substantially more time to complete the plan than to complete the risk assessment. We estimate that complying with this requirement will require 12 burden hours for each RNHCI at a cost of $498. Therefore, for all 18 RNHCIs to comply with these requirements will require an estimated 216 burden hours (12 burden hours for each RNHCI × 18 RNHCIs) at a cost of $8,964 ($498 estimated cost for each RNHCI × 18 RNHCIs).

Under this final rule, RNHCIs will be required to review and update their emergency preparedness plans at least annually. For the purpose of determining the burden associated with this requirement, we will expect that RNHCIs already review their plans annually. Based on our experience with Medicare providers and suppliers, healthcare facilities have a compliance officer or other staff member who periodically reviews the facility's program to ensure that it complies with all relevant federal, state, and local laws, regulations, and ordinances. While this requirement is subject to the PRA, we expect that complying with the requirement for an annual review of the emergency preparedness plan will constitute a usual and customary business practice as defined in the implementing regulation of the PRA at 5 CFR 1320.3(b)(2). Therefore, we have not assigned a burden.

Section 403.748(b) will require RNHCIs to develop and implement emergency preparedness policies and procedures in accordance with their emergency plan based on the emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). These policies and procedures will have to be reviewed and updated at least annually. At a minimum, we proposed that the policies and procedures be required to address the requirements specified in § 403.748(b)(1) through (8). The RNHCIs will need to review their policies and procedures and compare them to their emergency plan, risk assessment, and communication plan. Most RNHCIs will need to revise their existing policies and procedures or develop new policies and procedures.

The current RNHCI CoPs require them to have written policies concerning their services (§ 403.738). Thus, some RNHCIs may have some emergency preparedness policies and procedures. However, based on our experience with RNHCIs, most of their emergency preparedness policies address only evacuation from the facility.

We expect that these tasks will involve the administrator, the director of nursing, and the head of maintenance. All three will need to review and comment on the RNHCI's current policies and procedures. The director of nursing will revise or develop new policies and procedures, as needed, ensure that they are approved, and compile and disseminate them to the appropriate parties. We estimate that it will require 6 burden hours for each RNHCI to comply with this requirement at a cost of $234. Thus, it will require 108 burden hours (6 burden hours for each RNHCI × 18 RNHCIs) for all 18 RNHCIs to comply with the requirements in § 403.748(b)(1) through (8) at a cost of $4,212 ($234 estimated cost for each RNHCI × 18 RNHCIs).

Section 403.748(c) will require RNHCIs to develop and maintain an emergency preparedness communication plan that complies with both federal and state law and must be reviewed and updated at least annually. We proposed that the communication plan include the information specified at § 403.748(c)(1) through (7). The burden associated with complying with this requirement will be the resources required to review and, if necessary, revise an existing communication plan or develop a new plan. Based on our experience with RNHCIs, we expect that these activities will require the involvement of the RNHCI's administrator, the director of nursing, and the head of maintenance. We estimate that complying with this requirement will require 4 burden hours for each RNHCI at a cost of $166. Thus, it will require an estimated 72 burden hours (4 burden hours for each RNHCI × 18 RNHCIs) at a cost of $2,988 ($166 estimated cost for each RNHCI × 18 RNHCIs).

We proposed that RNHCIs will also have to review and update their emergency preparedness communication plan at least annually. We believe that RNHCIs already review their emergency preparedness communication plans periodically. Thus, complying with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulation of the PRA at 5 CFR 1320.3(b)(2). Therefore, we have not assigned a burden.

Section 403.748(d) will require RNHCIs to develop and maintain an emergency preparedness training and testing program that must be reviewed and updated at least annually. We are proposing that a RNHCI meet the requirements specified at § 403.748(d)(1) and (2). Section 403.748(d)(1) will require RNHCIs to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the RNHCI will have to provide training at least annually. Based on our experience, all RNHCIs have some type of emergency preparedness training program. However, all RNHCIs will need to compare their current emergency preparedness training programs to their risk assessments and updated emergency preparedness plans, policies and procedures, and communication plans and revise or, if necessary, develop new sections for their training programs.

We expect that complying with these requirements will require the involvement of the RNHCI administrator and the director of nursing. We estimate that it will require 7 burden hours for each RNHCI to develop an emergency training program at a cost of $314. Thus, it will require an estimated 126 burden hours (7 burden hours for each RNHCI × 18 RNHCIs) at a cost of $5,652 ($1855 estimated cost for each RNHCI × 18 RNHCI).

We are proposing that RNHCIs also review and update their emergency preparedness training and testing programs at least annually. Based on our experience with Medicare providers and suppliers, healthcare facilities have a compliance officer or other staff member who periodically reviews the facility's program to ensure that it complies with all relevant federal, state, and local laws, regulations, and ordinances. While this requirement is subject to the PRA, we expect that complying with this requirement will constitute a usual and customary business practice as defined in the implementing regulation of the PRA at 5 CFR 1320.3(b)(2). Therefore, we have not calculated an estimate of the burden.

Section 403.748(d)(2) will require RNHCIs to conduct a paper-based, tabletop exercise at least annually. The RNHCI must also analyze its response to and maintain documentation of all tabletop exercises and emergency events, and revise its emergency plan, as needed.

The burden associated with complying with this requirement will be the resources RNHCIs will need to develop the scenarios for the exercises and the necessary documentation. Based on our experience with RNHCIs, RNHCIs already conduct some type of exercise periodically to test their emergency preparedness plans. However, we expect that RNHCIs will not be fully compliant with our requirements. We expect that the director of nursing will develop the scenarios and required documentation. We estimate that these tasks will require 3 burden hours at a cost of $102 for each RNCHI. Based on this estimate, for all 18 RNHCIs to comply with these requirements will require 54 burden hours (3 burden hours for each RNHCI × 18 RNHCIs) at a cost of $1,836 ($102 estimated cost for each RNHCI × 18 RNHCI).

D. ICRs Regarding Condition for Coverage: Emergency Preparedness (§ 416.54)

Section 416.54(a) will require ASCs to develop and maintain an emergency preparedness plan and review and update that plan at least annually. We proposed that the plan must meet the requirements contained in § 416.54(a)(1) through (4).

We will discuss the burden for these activities individually in this final rule beginning with the risk assessment requirement in § 416.54(a)(1). We expect that each ASC will conduct a thorough risk assessment. This will require the ASC to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. We expect that an ASC will consider its location and geographical area; patient population, including those with disabilities and other access and functional needs; and the type of services the ASC has the ability to provide in an emergency. The ASC also will need to identify the measures it must take to ensure continuity of its operation, including delegations and succession plans.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment. As of June 2016, there are 5,485 ASCs. The current regulations covering ASCs include emergency preparedness requirements.

A significant factor in determining the burden is the accreditation status of an ASC. Of the 5,485 ASCs, 4,071 are non-accredited and 1,414 are accredited. Of the 1,414 accredited ASCs, we estimate that 491 are accredited by The Joint Commission (TJC), 731 by the AAAHC, and additional facilities are accredited by the AOA/HFAP or the AAAASF. The accreditation standards for these organizations vary in their requirements related to emergency preparedness. The AOA/HFAP's standards are very similar to the current ASC regulations. AAAASF does have some emergency preparedness requirements, such as requirements for responses or written protocols for security emergencies, for example, intruders and other threats to staff or patients; power failures; transferring patients; and emergency evacuation of the facility. However, the accreditation standards for both the AOA/HFAP and AAAASF will not significantly satisfy the ICRs contained in this final rule. Therefore, for the purpose of determining the burden imposed on ASCs by this final rule, we will include the ASCs that are accredited by both the AOA/HFAP and AAAASF with the non-accredited ASCs.

TJC and AAAHC's accreditation standards contain more extensive emergency preparedness requirements than the accreditation standards of either AOA/HFAP or AAAASF. For example, TJC standards contain requirements for risk assessments and an emergency management plan. AAAHC's standards include requirements for both internal and external emergencies and drills for the facility's internal emergency plan. Therefore, in discussing the individual burden requirements in this final rule, we will discuss the burden for the estimated 1,222 accredited ASCs by either the AAAHC or TJC (731 AAAHC-accredited ASCs + 491 TJC-accredited ASCs) separately from the remaining 4,263 (ASCs that are not accredited by an accrediting organization or accredited by the AOA/HFAP and AAAASF). For some requirements, only the TJC accreditation standards are significantly like those in the final rule. For those requirements, we will analyze the 491 TJC-accredited ASCs separately from the 4,994 non TJC-accredited ASCs (5,485 ASCs−491 TJC-accredited ASCs).

For the purpose of determining the burden for the TJC-accredited ASCs, we used TJC's Comprehensive Accreditation Manual for Ambulatory Care: The Official Handbook 2008 (CAMAC). Concerning the requirement for a risk assessment in § 416.54(a)(1), in the chapter entitled “Management of the Environment of Care” (EC), ASCs are required to conduct comprehensive, proactive risk assessments (CAMAC, CAMAC Refreshed Core, January 2007, (CAMAC), TJC Standard EC.1.10, EP 4, p. EC-9). In addition, ASCs must conduct a hazard vulnerability analysis (HVA) (CAMAC, Standard EC.4.10, EP 1, p. EC-12). The HVA requires the identification of potential emergencies and the effects those emergencies could have on the ASC's operations and the demand for its services (CAMAC, p. EC-12). We expect that TJC-accredited ASCs already conduct a risk assessment that complies with these requirements. If there are any tasks these ASCs need to complete to satisfy the requirement for a risk assessment, we expect that the burden imposed by this requirement will be negligible. For the 491 TJC-accredited ASCs, the risk assessment requirement will constitute a usual and customary business practice. While this requirement is subject to the PRA, we expect that complying with this requirement will constitute a usual and customary business practice as defined in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Therefore, we have not estimated the amount of regulatory burden For ASCs with accreditation from TJC.

For the purpose of determining the burden for the 731 AAAHC-accredited ASCs, we used the Accreditation Handbook for Ambulatory Health Care 2008 (AHAHC). The AAAHC standards do not contain a specific requirement for the ASC to perform a risk assessment. However, in discussing the requirement for drills, the AAAHC notes that such drills should be appropriate to the facility's activities and environment (AHAHC, Accreditation Association for Ambulatory Health Care, Inc., Core Standards, Chapter 8. Facilities and Environment, Element E, p. 37). Therefore, we expect that in fulfilling this core standard that the 731 AAAHC-accredited ASCs have performed some type of risk assessment. However, we do not expect that this will satisfy the requirement for a facility-based and community-based risk assessment that addresses the elements include in the AAAHC-accreditation for ASCs. Therefore, the 731 AAAHC-accredited ASCs will be included in the burden analysis with the ASCs that are non-accredited or are accredited by AOA/HFAP and AAAASF for the risk assessment requirement for 4,994 non TJC-accredited ASCs (5,485 total ASCs−491 TJC-accredited ASCs).

We expect that all ASCs have already performed at least some of the work needed for a risk assessment. However, many probably have not performed a thorough risk assessment. Therefore, we expect that all non TJC-accredited ASCs will perform thorough reviews of their current risk assessments, if they have them, and revise them to ensure they have updated the assessments and that they have included all of the requirements in § 416.54(a).

We have not designated any specific process or format for ASCs to use in conducting their risk assessments because we believe that ASCs, as well as other healthcare providers and suppliers, need maximum flexibility in determining the best way for their facilities to accomplish this task. However, we expect healthcare facilities to, at a minimum; include input from all of their major departments in the process of developing their risk assessments. Based on our experience working with ASCs, we expect that conducting the risk assessment will require the involvement of an administrator and a registered nurse. We expect that to comply with the requirements of this section, both of these individuals will need to attend an initial meeting, review the current assessment, prepare their comments, attend a follow-up meeting, perform a final review, and approve the risk assessment. In addition, we expect that the quality improvement nurse will coordinate the meetings; perform an initial review of the current risk assessment; provide suggestions or a critique of the risk assessment; coordinate comments; revise the original risk assessment; develop any necessary sections for the risk assessment; and ensure that the appropriate parties approve the new risk assessment. We estimate that complying with this risk assessment requirement will require 8 burden hours for each ASC at a cost of $763. Based on that estimate, it will require 39,952 burden hours (8 burden hours for each ASC × 4,994 non TJC-accredited ASCs) for all non TJC-accredited ASCs to comply with this risk assessment requirement at a cost of $3,810,422 ($763 estimated cost for each ASC × 4,994 ASCs).

After conducting the risk assessment, ASCs will be required to develop and maintain emergency preparedness plans in accordance with § 416.54(a)(1) through (4). All TJC-accredited ASCs must already comply with many of the requirements in § 416.54(a). All TJC-accredited ASCs are already required to develop and maintain a “written emergency management plan describing the process for disaster readiness and emergency management” (CAMAC, Standard EC.4.10, EP 3, EC-13). We expect that the TJC-accredited ASCs already have emergency preparedness plans that comply with these requirements. If there are any activities required to comply with these requirements, we expect that the burden will be negligible. Thus, for 491 TJC-accredited ASCs, this requirement will constitute a usual and customary business practice for these ASCs in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Therefore, we will not include this activity in the burden analysis for those ASCs.

AAAHC-accredited ASCs are required to have a “comprehensive emergency plan to address internal and external emergencies” (AHAC, Chapter 8. Facilities and Environment, Element D, p. 37). However, we do not believe that this requirement ensures compliance with all of the requirements for an emergency plan. We will include the 731 AAAHC-accredited ASCs in the burden analysis for this requirement.

We expect that the 4,994 non TJC-accredited ASCs have developed some type of emergency preparedness plan. However, under this final rule, all of these ASCs will have to review their current plans and compare them to the risk assessments they performed in accordance with § 416.54(a)(1). The ASCs will then need to update, revise, and in some cases, develop new sections to ensure that their plans incorporate their risk assessments and address all of the requirements. The ASC will also need to review, revise, and, in some cases, develop the delegations of authority and succession plans that ASCs determine are necessary for the appropriate initiation and management of their emergency preparedness plans.

The burden associated with this requirement will be the time and effort necessary to develop an emergency preparedness plan that complies with all of the requirements in § 416.54(a)(1) through (4). Based upon our experience with ASCs, we expect that the administrator and the quality improvement nurse who will be involved in the risk assessment will also be involved in developing the emergency preparedness plan. We estimate that complying with this requirement will require 11 burden hours for each ASC at a cost of $937. Therefore, based on that estimate, for the 4,994 non TJC-accredited ASCs to comply with the requirements in this section will require 54,934 burden hours (11 burden hours for each non TJC-accredited ASC × 4,994 non TJC-accredited ASCs) at a cost of $4,679,378 ($937 estimated cost for each non TJC-accredited ASC × 4,994 non TJC-accredited ASCs).

All of the ASCs will also be required to review and update their emergency preparedness plans at least annually. For the purpose of determining the burden for this requirement, we will expect that ASCs will review their plans annually. All ASCs have a professional staff person, a quality improvement nurse, whose responsibility entails ensuring that the ASC is delivering quality patient care and that the ASC is complying with regulations concerning patient care. We expect that the quality improvement nurse will be primarily responsible for the annual review of the ASC's emergency preparedness plan. We expect that complying with this requirement will constitute a usual and customary business practice for ASCs in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Therefore, we will not include this activity in the burden analysis.

Section 416.54(b) proposed that each ASC be required to develop and implement emergency preparedness policies and procedures, based on the emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan set forth in paragraph (c). We will require ASCs to review and update these policies and procedures at least annually. These policies and procedures will be required to include, at a minimum, the requirements listed at § 416.54(b)(1) through (7). We expect that ASCs will develop emergency preparedness policies and procedures based upon their risk assessments, emergency preparedness plans, and communication plans. Therefore, ASCs will need to thoroughly review their emergency preparedness policies and procedures and compare them to all of the information previously noted. The ASCs will then need to revise, or in some cases, develop new policies and procedures that will ensure that the ASCs' emergency preparedness plans address the specific elements.

TJC accreditation standards already require many of the specific elements that are required in this section. For example, in the chapter entitled “Leadership” (LD), TJC-accredited ASCs are required to “develop policies and procedures that guide and support patient care, treatment, and services” (CAMAC, Standard LD.3.90, EP 1, p. LD-12a). In addition, TJC-accredited ASCs must already address or perform a HVA; processes for communicating with and assigning staff under emergency conditions; provision of subsistence or critical needs; evacuation of the facility; and alternate sources for fuel, water, electricity, etc. (CAMAC, Standard EC.4.10, EPs 1, 7-10, 12, and 20, pp. EC-12-13). They must also critique their drills and modify their emergency management plans in response to the critiques (CAMAC, Standard EC.4.20, EPs 12-16, pp. EC-14-14a). In the chapter entitled, “Management of Information” (IM), they are required to protect and preserve the privacy and confidentiality of sensitive data (CAMAC, Standard IM.2.10, EPs 1 and 9, p. IM-6). If TJC-accredited ASCs have any tasks required to satisfy these requirements, we expect they will constitute only a negligible burden. For the 491 TJC-accredited ASCs, the requirement for emergency preparedness policies and procedures will constitute a usual and customary business practice in accordance with the implementing regulations of the PRA 5 CFR 1320.3(b)(2). Therefore, we will not include this activity in the burden analysis for these 491 TJC-accredited ASCs.

AAAHC standards require ASCs to have “the necessary personnel, equipment and procedures to handle medical and other emergencies that may arise in connection with services sought or provided” (AHAHC, Chapter 8. Facilities and Environment, Element B, p. 37). Although, we expect that AAAHC-accredited ASCs probably already have policies and procedures that address at least some of the requirements, we expect that they will sustain a considerable burden in satisfying all of the requirements. We will include the AAAHC-accredited ASCs with the non-accredited ASCs in determining the burden for the requirements in § 416.54(b).

We expect that all of the 4,994 non TJC-accredited ASCs have some emergency preparedness policies and procedures. However, we expect that all of these ASCs will need to review their policies and procedures and revise their policies and procedures to ensure that they address all of the requirements. We expect that the quality improvement nurse will initially review the ASC's emergency preparedness policies and procedures. The quality improvement nurse will send any recommendations for changes or additional policies or procedures to the ASC's administrator. The administrator and quality improvement nurse will need to make the necessary revisions and draft any necessary policies and procedures. We estimate that for each non TJC-accredited ASC to comply with this requirement will require 9 burden hours at a cost of $717. For the 4,994 ASCs to comply with this requirement, it will require an estimated 44,946 burden hours (9 burden hours for each non TJC-accredited ASC × 4,994 non TJC-accredited ASCs) at a cost of $3,580,698. ($717 estimated cost for each non TJC-accredited ASC × 4,994 ASCs).

Section 416.54(c) will require each ASC to develop and maintain an emergency preparedness communication plan that complies with both federal and state law. We also proposed that ASCs will have to review and update these plans at least annually. These communication plans will have to include the information listed in § 416.54(c)(1) through (7). The burden associated with developing and maintaining an emergency preparedness communication plan will be the time and effort necessary to review, revise, and, if necessary, develop new sections for the ASC's emergency preparedness communications plan to ensure that it satisfied these requirements.

TJC-accredited ASCs are required to have a plan that “identifies backup internal and external communication systems in the event of failure during emergencies” (CAMAC, Standard EC.4.10, EP 18, p. EC-13). There are also requirements for identifying, notifying, and assigning staff, as well as notifying external authorities (CAMAC, Standard EC.4.10, EPs 7-9, p. EC-13). In addition, the facility's plan must provide for controlling information about patients (CAMAC, Standard EC.4.10, EP 10, p. EC-13). If any revisions or additions are necessary to satisfy the requirements, we expect the revisions or additions will be those incurred during the course of normal business and thereby impose no additional burden. Thus, for the TJC-accredited ASCs, the requirements for the emergency preparedness communication plan will constitute a usual and customary business practice for ASCs as stated in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Thus, we will not include this activity by these TJC-accredited ASCs in the burden analysis.

The AAAHC standards do not have a specific requirement for a communication plan for emergencies. However, AAAHC-accredited ASCs are required to have the “necessary personnel, equipment and procedures to handle medical and other emergencies that may arise in connection with services sought or provided (AAAHC, 8. Facilities and Environment, Element B, p. 37) and “a comprehensive emergency plan to address internal and external emergencies” (AAAHC, 8. Facilities and Environment, Element D, p. 37). Since AAAHC does have a specific requirement for a communication plan, we will include the AAAHC-accredited ASCs in with the non-accredited ASCs in determining the burden for these requirements for a total of 4,994 non TJC-accredited ASCs (5,485 total ASCs−491 TJC accredited ASCs).

We expect that all non TJC-accredited ASCs currently have some type of emergency preparedness communication plan. It is standard practice in the healthcare industry to have and maintain contact information for both staff and outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the facility, such as cell phones; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. We expect that all ASCs already satisfy the requirements in § 416.54(c)(1) through (4). However, for the requirements in § 416.54(c)(5) through (7), all ASCs will need to review, revise, and, if necessary, develop new sections for their plans to ensure that they include all of the requirements. We expect that this will require the involvement of the ASC's administrator and a registered nurse. We estimate that complying with this requirement will require 4 burden hours at a cost of $323. Therefore, for all non TJC-accredited ASCs to comply with the requirements in this section will require an estimated 19,976 burden hours (4 hours for each non TJC-accredited ASC × 4,994 non TJC-accredited ASCs) at a cost of $1,613,062 ($323 estimated cost for each non TJC-accredited ASC × 4,994 non TJC-accredited ASCs).

We also proposed that ASCs must review and update their emergency preparedness communication plans at least annually. We believe that ASCs already review their emergency preparedness communication plans periodically. Therefore, we believe complying with this requirement will constitute a usual and customary business practice for ASCs as stated in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 416.54(d) will require ASCs to develop and maintain emergency preparedness training and testing programs that ASCs must review and update at least annually. Specifically, ASCs must meet the requirements listed at § 416.54(d)(1) and (2).

The burden associated with complying with these requirements will be the time and effort necessary for an ASC to review, update, and, in some cases, develop new sections for its emergency preparedness training program. Since ASCs are currently required to conduct drills, at least annually, to test their disaster plan's effectiveness, we expect that all ASCs already provide training on their emergency preparedness policies and procedures. However, all ASCs will need to review their current training and testing programs and compare their contents to their risk assessments, emergency preparedness plans, policies and procedures, and communication plans.

Section 416.54(d)(1) will require ASCs to provide initial training in their emergency preparedness policies and procedures to all new and existing staff, individuals providing on-site services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. ASCs will have to ensure that their staff can demonstrate knowledge of emergency procedures. Thereafter, ASCs will have to provide the training at least annually. TJC-accredited ASCs must provide an initial orientation to their staff and independent practitioners (CAMAC, Standard 2.10, HR-8). They must also provide “on-going education, including in-services, training, and other activities” to maintain and improve staff competence (CAMAC, Standard 2.30, HR-9). We expect that these TJC-accredited ASCs include some training on their facilities' emergency preparedness policies and procedures in their current training programs. However, these requirements do not contain any requirements for training volunteers. Thus, TJC accreditation standards do not ensure that TJC-accredited ASCs are already fulfilling all of the requirements, and we expect that the TJC-accredited ASCs will incur a burden complying with these requirements. Therefore, we will include these TJC-accredited ASCs in determining the burden for these requirements.

The AAAHC-accredited ASCs are already required to ensure that “all health care professionals have the necessary and appropriate training and skills to deliver the services provided by the organization” (AAAHC, Chapter 4. Quality of Care Provided, Element A, p. 28). Since these ASCs are required to have an emergency plan that addresses internal and external emergencies, we expect that all of the AAAHC-accredited ASCs already are providing some training on their emergency preparedness policies and procedures. However, this requirement does not include any requirement for annual training or for any training for staff that are not healthcare professionals. This AAAHC-accredited requirement does not ensure that these ASCs are already complying with the requirements. Therefore, we will include these AAAHC-accredited ASCs in determining the information collection burden for these requirements.

Based upon our experience with ASCs, we expect that all 5,485 ASCs have some type of emergency preparedness training program. We also expect that these ASCs will need to review their training programs and compare them to their risk assessments, emergency preparedness plans, policies and procedures, and communication plans. The ASCs will then need to make any necessary revisions to their training programs to ensure they comply with these requirements. We expect that complying with this requirement will require the involvement of an administrator and a quality improvement nurse. We estimate that for each ASC to develop a comprehensive emergency training program will require 6 burden hours at a cost of $465. Therefore, the estimated annual burden for all 5,485 ASCs to comply with these requirements is 32,910 burden hours (6 burden hours × 5,4855 ASCs) at an estimated cost of $2,550,525 ($465 estimated cost for each ASC × 5,485 ASCs).

We proposed that ASCs will also have to review and update their emergency preparedness training programs at least annually. For the purpose of determining the burden for this requirement, we will expect that ASCs will review their emergency preparedness training program annually. We expect that all ASCs have a quality improvement nurse responsible for ensuring that the ASC is delivering quality patient care and that the ASC is complying with patient care regulations. We expect that a registered nurse will be primarily responsible for the annual review of the ASC's emergency preparedness training program. Thus, in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2), we believe complying with this requirement will constitute a usual and customary business practice for ASCs. Thus, we will not include this activity in this burden analysis.

Section 416.54(d)(2) will require ASCs to participate in a full-scale exercise at least annually. ASCs will also have to participate in one additional testing exercise of their choice at least annually. If the ASC experiences an actual natural or man-made emergency that requires activation of their emergency plan, the ASC will be exempt from the requirement for a full-scale exercise for 1 year following the onset of the actual event. ASCs will also be required to analyze their response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise their emergency plans, as needed. To comply with this requirement, ASCs will need to develop a scenario for each drill and exercise. ASCs will also need to develop the documentation necessary for recording what happened during the testing exercises and emergency events and analyze their responses to these events.

TJC-accredited ASCs are required to regularly test their emergency management plans at least twice a year, critique each exercise, and modify their emergency management plans in response to those critiques (CAMAC, Standard EC.4.20, EP 1 and 12-16, p. EC-14-14a). In addition, the scenarios for these drills should be realistic and related to the priority emergencies the ASC identified in its HVA (CAMAC, Standard EC.4.20, EP 5, p. EC-14). However, the EPs for this standard do not contain any requirements for the drills to be community-based; for there to be a paper-based, tabletop exercise; or for the ASCs to maintain documentation of these testing exercises or emergency events. These TJC accreditation requirements do not ensure that TJC-accredited ASCs are already complying with these requirements. Therefore, the TJC-accredited ASCs will be included in the burden estimate.

The AAAHC-accredited ASCs already are required to perform at least four drills annually of their internal emergency plans (AAAHC, Chapter 8. Facilities and Environment, Element E, p. 37). However, there is no requirement for a paper-based, tabletop exercise; for a community-based drill; or for the ASCs to maintain documentation of their testing exercises or emergency events. This AAAHC accreditation requirement does not ensure that AAAHC-accredited ASCs are already complying with these requirements. Therefore, the AAAHC-accredited ASCs will be included in the burden estimate.

Based on our experience with ASCs, we expect that all of the 5,485 ASCs will be required to develop scenarios for their testing exercises and the documentation necessary to record and analyze these events, as well as any emergency events. Although we believe many ASCs may have developed scenarios and documentation for whatever type of drills or exercises they had previously performed, we expect all ASCs will need to ensure that the testing of their emergency preparedness plans comply with these requirements. Based upon our experience with ASCs, we expect that complying with this requirement will require the involvement of an administrator and a registered nurse. We estimate that for each ASC to comply will require 5 burden hours at a cost of $394. Therefore, for all 5,485 ASCs to comply with this requirement will require an estimated 27,425 burden hours (5 burden hours for each ASC × 5,485 ASCs) at a cost of $2,161,090 ($394 estimated cost for each ASC × 5,485 ASCs).

E. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 418.113)

Section 418.113(a) will require hospices to develop and maintain an emergency preparedness plan that must be reviewed and updated at least annually. We proposed that the plan meet the criteria listed in § 418.113(a)(1) through (4).

Although § 418.113(a) is entitled “Emergency Plan” and the requirement for the plan is stated first, the emergency plan must include and be based upon a risk assessment. Therefore, since hospices must perform their risk assessments before beginning, or at least before they complete, their plans, we will discuss the burden related to performing the risk assessment first.

Section 418.113(a)(1) will require all hospices to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. We expect that in performing a risk assessment, a hospice will need to consider its physical location, the geographic area in which it is located, and its patient population.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment. There are 4,401 hospices. There are 3,989 hospices that provide care only to patients in their homes (home health based and freestanding hospices) and 412 hospices that offer inpatient care directly (hospital, SNF, and NF based hospices). When we use the term “inpatient hospice,” we are referring to a hospice that operates its own inpatient care facility; that is, the hospice provides the inpatient care itself. By “outpatient hospices”, we are referring to hospices that only provide in-home care, and contract with other facilities to provide inpatient care. The current requirements for hospices contain emergency preparedness requirements for inpatient hospices only (§ 418.110). Inpatient hospices must have “a written disaster preparedness plan in effect for managing the consequences of power failures, natural disasters, and other emergencies that will affect the hospice's ability to provide care,” as stated in § 418.110(c)(1)(ii). Thus, we expect inpatient hospices already have performed some type of risk assessment during the process of developing their disaster preparedness plan. However, these risk assessments may not be documented or may not address all of the requirements under § 418.113(a). Therefore, we believe that all inpatient hospices will have to conduct a thorough review of their current risk assessments and then perform the necessary tasks to ensure that their facilities' risk assessments comply with these requirements.

We have not designated any specific process or format for hospices to use in conducting their risk assessments because we believe hospices need maximum flexibility in determining the best way for their facilities to accomplish this task. However, we believe that in the process of developing a risk assessment, healthcare institutions should include representatives from or obtain input from all of their major departments. Based on our experience with hospices, we expect that conducting the risk assessment will require the involvement of the hospice's administrator and an interdisciplinary group (IDG). The current Hospice CoPs require every hospice to have an IDG that includes a physician, registered nurse, social worker, and pastoral or other counselor. The responsibilities of one of a hospice's IDGs, if they have more than one, include the establishment of “policies governing the day-to-day provision of hospice care and services” (§ 418.56(a)(2)). Thus, we believe the IDG will be involved in performing the risk assessment.

We expect that members of the IDG will attend an initial meeting; review any existing risk assessment; develop comments and recommendations for changes to the assessment; attend a follow-up meeting; perform a final review; and approve the risk assessment. We expect that the administrator will coordinate the meetings, perform an initial review of the current risk assessment, provide a critique of the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and ensure that the necessary staff approves the new risk assessment. We believe it is likely that the administrator will spend more time reviewing and working on the risk assessment than the other individuals in the IDG. We estimate it will require 10 burden hours to review and update the risk assessment at a cost of $759. There are 412 inpatient hospices. Therefore, based on that estimates, it will require 4,120 burden hours (10 burden hours for each inpatient hospice × 412 inpatient hospices) for all inpatient hospices to comply with this requirement at a cost of $312,708 ($759 estimated cost for each inpatient hospice × 412 inpatient hospices).

There are no emergency preparedness requirements in the current hospice CoPs for hospices that provide care to patients in their homes. However, it is standard practice for healthcare facilities to plan and prepare for common emergencies, such as fires, power outages, and storms. Although we expect that these hospices have considered at least some of the risks they might experience, we anticipate that these facilities will require more time than an inpatient hospice to perform a risk assessment. We estimate that each hospice that provides care to patients in their homes will require 12 burden hours to develop its risk assessment at a cost of $899. Therefore, based on that estimate, for all 3,989 hospices that provide care to patients in their homes, it will require 47,868 burden hours (12 burden hours for each hospice × 3,989 hospices) to comply with this requirement at a cost of $3,586,111 ($899 estimated cost for each hospice × 3,989 hospices). Based on the previous calculations, we estimate that for all 4,401 hospices to develop a risk assessment will require 51,988 burden hours at a cost of $3,898,819.

After conducting the risk assessments, hospices will have to develop and maintain emergency preparedness plans that they will have to review and update at least annually. We expect all hospices to compare their current emergency plans, if they have them, to the risk assessments they performed in accordance with § 418.113(a)(1). In addition, hospices will have to comply with the requirements in § 418.113(a)(1) through (4). They will then need to review, revise, and, if necessary, develop new sections of their plans to ensure they comply with these requirements.

The current hospice CoPs require inpatient hospices to have “a written disaster preparedness plan in effect for managing the consequences of power failures, natural disasters, and other emergencies that will affect the hospice's ability to provide care” (§ 418.110(c)(1)(ii)). We believe that all inpatient hospices already have some type of emergency preparedness or disaster plan. However, their plans may not address all likely medical and non-medical emergency events identified by the risk assessment. Furthermore, their plans may not include strategies for addressing likely emergency events or address their patient population; the type of services they have the ability to provide in an emergency; or continuity of operations, including delegations of authority and succession plans. We expect that an inpatient hospice will have to review its current plan and compare it to its risk assessment, as well as to the other requirements we proposed. We expect that most inpatient hospices will need to update and revise their existing emergency plans, and, in some cases, develop new sections to comply with our requirements.

The burden associated with this requirement will be the time and effort necessary to develop an emergency preparedness plan or to review, revise, and develop new sections for an existing emergency plan. Based upon our experience with inpatient hospices, we expect that these activities will require the involvement of the hospice's administrator and an IDG, that is, a physician, registered nurse, social worker, and counselor. We believe that developing the plan will require more time to complete than the risk assessment.

We expect that these individuals will have to attend an initial meeting, review relevant sections of the facility's current emergency preparedness or disaster plan(s), develop comments and recommendations for changes to the facility's plan, attend a follow-up meeting, perform a final review, and approve the emergency plan. We expect that the administrator will probably coordinate the meetings, perform an initial review of the current emergency plan, provide a critique of the emergency plan, offer suggested revisions, coordinate comments, develop the new emergency plan, and ensure that the necessary parties approve the new emergency plan. We expect the administrator will probably spend more time reviewing and working on the emergency plan than the other individuals. We estimate that it will require 14 burden hours for each inpatient hospice to develop its emergency preparedness plan at a cost of $1,159. Based on this estimate, it will require 5,768 burden hours (14 burden hours for each inpatient hospice × 412 inpatient hospices) for all inpatient hospices to complete their plans at a cost of $477,508 ($1,159 estimated cost for each inpatient hospice × 412 inpatient hospices).

As discussed earlier, we have no current regulatory requirement for hospices that provide care to patients in their homes to have emergency preparedness plans. However, it is standard practice for healthcare providers to plan for common emergencies, such as fires, power outages, and storms. Although we expect that these hospices already have some type of emergency or disaster plan, each hospice will need to review its emergency plan to ensure that it addressed the risks identified in its risk assessment and complied with the requirements. We expect that an administrator and the individuals from the hospice's IDG will be involved in reviewing, revising, and developing a facility's emergency plan. However, since there are no current requirements for hospices that provide care to patients in their homes have emergency plans, we believe it will require more time for each of these hospices than for inpatient hospices to complete an emergency plan. We estimate that for each hospice that provides care to patients in their homes to comply with this requirement will require 20 burden hours at an estimated cost of $1,599. Based on that estimate, for all 3,989 of these hospices to comply with this requirement will require 79,780 burden hours (20 burden hours for each hospice × 3,989 hospices) at a cost of $6,378,411 ($1,599 estimated cost for each hospice × 3,989 hospices). We estimate that for all 4,401 hospices to develop an emergency preparedness plan will require 6,378,411 burden hours at a cost of $6,855,919.

Hospices will also be required to review and update their emergency preparedness plans at least annually. The current hospice CoPs require inpatient hospices to periodically review and rehearse their disaster preparedness plan with their staff, including non-employee staff (42 CFR 418.110(c)(1)(ii)). For purposes of this burden estimate, we will expect that under this final rule, inpatient hospices will review their emergency plans prior to reviewing them with all of their employees and that this review will occur annually.

Outpatient hospices, either home based or freestanding, on the other hand, currently do not have emergency preparedness requirements in the current hospice CoPs and as such, there is no requirement for an annual review of the plan. Therefore, we will analyze the burden from this requirement for outpatient hospices.

Based on our experience with outpatient hospices, we expect that the same individuals who develop the emergency preparedness plan will annually review and update the plan. These staff would include the administrator, physician, counselor, social worker, and registered nurse. We estimate that for each hospice that provides care to patients in an outpatient setting to comply with this requirement will require 8 burden hours at an estimated cost of $619. Based on that estimate, for all 3,989 of these hospices to comply with this requirement will require 31,912 burden hours (8 burden hours for each hospice × 3,989 hospices) at a cost of $2,469,191 ($619 estimated cost for each hospice × 3,989 hospices).

We expect that all hospices, both inpatient and those that provide care to patients in their homes, have an administrator who is responsible for the day-to-day operation of the hospice. Day-to-day operations will include ensuring that all of the hospice's plans are up-to-date and in compliance with relevant federal, state, and local laws, regulations, and ordinances. In addition, it is standard practice in healthcare organizations to have a professional employee, an administrator, who periodically reviews their plans and procedures. We expect that complying with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Thus, we will not include this activity in the burden analysis.

Section 418.113(b) will require each hospice to develop and implement emergency preparedness policies and procedures, based on the emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). It will also require hospices to review and update these policies and procedures at least annually. At a minimum, the hospice's policies and procedures will be required to address the requirements listed at § 418.113(b)(1) through (6).

We expect that all hospices have some emergency preparedness policies and procedures because the current hospice CoPs for inpatient hospices already require them to have “a written disaster preparedness plan in effect for managing the consequences of power failures, natural disasters, and other emergencies that will affect the hospice's ability to provide care” (§ 418.110(c)(1)(ii)). In addition, the responsibilities for at least one of a hospice's IDGs, if they have more than one, include the establishment of “policies governing the day-to-day provision of hospice care and services” (§ 418.56(a)(2)). However, we also expect that all inpatient hospices will need to review their current policies and procedures, assess whether they contain everything required by their facilities' emergency preparedness plans, and revise and update them as necessary.

The burden associated with reviewing, revising, and updating a hospice's emergency policies and procedures will be the resources needed to ensure they comply with these requirements. Since at least one of a hospice's IDGs will be responsible for developing policies that govern the daily care and services for hospice patients (42 CFR 418.56(a)(2)), we expect that an IDG will be involved with reviewing and revising a hospice's existing policies and procedures and developing any necessary new policies and procedures. We estimate that an inpatient hospice's compliance with this requirement will require 8 burden hours at a cost of $619. Therefore, based on that estimate, all 412 inpatient hospices' compliance with this requirement will require 3,296 burden hours (8 burden hours for each inpatient hospice × 412 inpatient hospices) at a cost of $255,028 ($619 estimated cost for each inpatient hospice × 412 inpatient hospices).

Although there are no existing regulatory requirements for hospices that provide care to patients in their homes to have emergency preparedness policies and procedures, it is standard practice for healthcare organizations to prepare for common emergencies, such as fires, power outages, and storms. We expect that these hospices already have some emergency preparedness policies and procedures. However, under this final rule, the IDG for these hospices will need to accomplish the same tasks as described earlier for inpatient hospices to ensure that these policies and procedures comply with the requirements.

We estimate that each hospice's compliance with this requirement will require 9 burden hours at a cost of $699. Therefore, based on that estimate, all 3,989 hospices that provide care to patients in their homes to comply with this requirement will require 35,901 burden hours (9 burden hours for each hospice × 3,989 hospices) at a cost of $2,788,311 ($699 estimated cost for each hospice × 3,989 hospices).

Thus, we estimate that development of emergency preparedness policies and procedures for all 4,401 hospices will require 39,197 burden hours at a cost of $3,043,339.

Section 418.113(c) will require a hospice to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. Hospices will also have to review and update their plans at least annually. The communication plan will have to include the requirements listed at § 418.113(c)(1) through (7).

We believe that all hospices already have some type of emergency preparedness communication plan. Although only inpatient hospices have a current requirement for disaster preparedness (§ 418.110(c)), it is standard practice for healthcare organizations to maintain contact information for their staff and for outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the organization (for example, cell phones); and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. However, many hospices, both inpatient hospices and hospices that provide care to patients in their homes, may not have formal, written emergency preparedness communication plans. We expect that all hospices will need to review, update, and in some cases, develop new sections for their plans to ensure that those plans include all of the elements we proposed requiring for hospice communication plans.

The burden associated with complying with this requirement will be the resources required to ensure that the hospice's emergency communication plan complied with these requirements. Based upon our experience with hospices, we anticipate that satisfying these requirements will require only the involvement of the hospice's administrator. Thus, for each hospice, we estimate that complying with this requirement will require 3 burden hours at a cost of $240. Therefore, based on that estimate, compliance with this requirement for all 4,401 hospices will require 13,203 burden hours (3 burden hours for each hospice × 4,401 hospices) at a cost of $1,056,240 ($240 estimated cost for each hospice × 4,401 hospices).

Section 418.113(d) will require each hospice to develop and maintain an emergency preparedness training and testing program that will be reviewed and updated at least annually. Section 418.113(d)(1) will require hospices to provide initial training in emergency preparedness policies and procedures to all hospice employees, consistent with their expected roles, and maintain documentation of the training. The hospice will also have to ensure that their employees could demonstrate knowledge of their emergency procedures. Thereafter, the hospice will have to provide emergency preparedness training at least annually. Hospices will also be required to periodically review and rehearse their emergency preparedness plans with their employees, with special emphasis placed on carrying out the procedures necessary to protect patients and others.

Under current regulations, all hospices are required to provide an initial orientation and in-service training and educational programs, as necessary, to each employee (§ 418.100(g)(2) and (3)). They must also provide employee orientation and training consistent with hospice industry standards (§ 418.78(a)). In addition, inpatient hospices must periodically review and rehearse their disaster preparedness plans with their staff, including non-employee staff (§ 418.110(c)(1)(ii)). We expect that all hospices already provide training to their employees on the facility's existing disaster plans, policies, and procedures. However, under this final rule, all hospices will need to review their current training programs and compare their contents to their updated emergency preparedness plans, policies and procedures, and communications plans. Hospices will then need to review, revise, and in some cases, develop new material for their training programs so that they complied with these requirements.

The burden associated with the previously discussed requirements will be the time and effort necessary for a hospice to bring itself into compliance with the requirements in this section. We expect that compliance with this requirement will require the involvement of a registered nurse. We expect that the registered nurse will compare the hospice's current training program with the facility's emergency preparedness plan, policies and procedures, and communication plan, and then make any necessary revisions, including the development of new training material, as needed. We estimate that these tasks will require 6 burden hours at a cost of $360. Based on this estimate, compliance by all 4,401 hospices will require 26,406 burden hours (6 burden hours for each hospice × 4,401 hospices) at a cost of $1,584,360 ($360 estimated cost for each hospice × 4,401 hospices). We are proposing that hospices also be required to review and update their emergency preparedness training programs at least annually.

Section 418.113(d)(2) will require hospices to participate in a full-scale exercise at least annually. Hospices are also required to participate in one additional testing exercise of their choice at least annually. Hospices will also be required to analyze their responses to and maintain documentation of all their drills, tabletop exercises, and emergency events, and revise their emergency plans, as needed. To comply with this requirement, a hospice will need to develop scenarios for their drills and exercises. A hospice also will have to develop the required documentation.

Hospices will also have to periodically review and rehearse their emergency preparedness plans with their staff (including nonemployee staff), with special emphasis on carrying out the procedures necessary to protect patients and others (§ 418.110(c)(1)(ii)). However, this periodic rehearsal requirement does not ensure that hospices are performing any type of drill or exercise annually or that they are documenting their responses. In addition, there is no requirement in the current CoPs for outpatient hospices to have an emergency plan or for these hospices to test any emergency procedures they may currently have. We believe that developing the scenarios for these drills and exercises and the documentation necessary to record the events during testing exercises and emergency events will be new requirements for all hospices.

The associated burden will be the time and effort necessary for a hospice to comply with these requirements. We expect that complying with these requirements will require the involvement of a registered nurse. We expect that the registered nurse will develop the necessary documentation and the scenarios for the drills and exercises. We estimate that these tasks will require 4 burden hours at an estimated cost of $240. Based on this estimate, in order for all 4,401 hospices to comply with these requirements, it will require 17,604 burden hours (4 burden hours for each hospice × 4,401 hospices) at a cost of $1,056,240 ($240 estimated cost for each hospice × 4,401 hospices).

Thus, for all 4,401 hospices to comply with all of the requirements in § 418.113, it will require an estimated 265,858 burden hours at a cost of $19,964,108.

Comment: A commenter expressed that we underestimated the burden and additional cost for hospices to comply with these requirements since hospice providers will be fairly new to many of these standards. The commenter indicated that hospices have not typically been participants in local, state, or federal emergency preparedness and response plans, so they will have to work even harder than other providers to build connections. The commenter suggested that CMS re-evaluate the burden estimates in the COI section for hospices.

Response: We agree that hospices may not be typically involved in local, state, or federal emergency planning, however, as we stated, it is standard practice for healthcare providers to plan for common emergencies, such as fires, power outages, and storms. We expect that hospices already have some type of emergency or disaster plan, therefore we assigned burden based on the principle that each hospice will need to review its current emergency plan to ensure that it addressed the risks identified in its risk assessment and complies with the requirements. We also expect that all hospices have some emergency preparedness policies and procedures because the current hospice CoPs for inpatient hospices already require them to have “a written disaster preparedness plan in effect for managing the consequences of power failures, natural disasters, and other emergencies that will affect the hospice's ability to provide care” (42 CFR 418.110(c)(1)(ii)). Given these current CoPs, we believe that the burden estimates for hospices are appropriate.

F. ICRs Regarding Emergency Preparedness (§ 441.184)

Section 441.184(a) will require Psychiatric Residential Treatment Facilities (PRTFs) to develop and maintain emergency preparedness plans and review and update those plans at least annually. We proposed that these plans meet the requirements listed at § 441.184(a)(1) through (4).

Section § 441.184(a)(1) will require each PRTF to develop a documented, facility-based and community-based risk assessment that will utilize an all-hazards approach. We expect that all PRTFs have already performed some of the work needed for a risk assessment because it is standard practice for healthcare facilities to prepare for common hazards, such as fires and power outages, and disasters or emergencies common in their geographic area, such as snowstorms or hurricanes. However, many PRTFs may not have documented their risk assessments or performed one that will comply with all of our requirements. Therefore, we expect that all PRTFs will have to review and revise their current risk assessments.

We do not designate any specific process or format for PRTFs to use in conducting their risk assessments because we believe that PRTFs need maximum flexibility to determine the best way to accomplish this task. However, we expect that PRTFs will include representation from or seek input from all of their major departments. Based on our experience with PRTFs, we expect that conducting the risk assessment will require the involvement of the PRTF's administrator, a psychiatric registered nurse, and a clinical social worker. We expect that all of these individuals will attend an initial meeting, review their current assessment, develop comments and recommendations for changes, attend a follow-up meeting, perform a final review, and approve the new risk assessment. We expect that the psychiatric registered nurse will coordinate the meetings, perform an initial review, offer suggested revisions, coordinate comments, develop a new risk assessment, and ensure that the necessary parties approve the new risk assessment. We also expect that the psychiatric registered nurse will spend more time reviewing and working on the risk assessment than the other individuals. We estimate that in order for each PRTF to comply, it will require 8 burden hours at a cost of $544. There are currently 377 PRTFs. Therefore, based on that estimate, compliance by all PRTFs will require 3,016 burden hours (8 burden hours for each PRTF × 377 PRTFs) at a cost of $205,088 ($544 estimated cost for each PRTF × 377 PRTFs).

After conducting the risk assessment, § 441.184(a)(1) through (4) will require PRTFs to develop and maintain an emergency preparedness plan. Although it is standard practice for healthcare facilities to have some type of emergency preparedness plan, all PRTFs will need to review their current plans and compare them to their risk assessments. Each PRTF will need to update, revise, and, in some cases, develop new sections to complete its emergency preparedness plan.

Based upon our experience with PRTFs, we expect that the administrator and psychiatric registered nurse who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we expect it will require substantially more time to complete the plan than the risk assessment. We expect that the psychiatric nurse will be the most heavily involved in reviewing and developing the PRTF's emergency preparedness plan. We also expect that a clinical social worker will review the drafts of the plan and provide comments on it to the psychiatric registered nurse. We estimate that for each PRTF to comply with this requirement will require 12 burden hours at a cost of $858. Thus, we estimate that it will require 4,524 burden hours (12 burden hours for each PRTF × 377 PRTFs) for all PRTFs to comply with this requirement at a cost of $323,466 ($858 estimated cost per PRTF × 377 PRTFs).

The PRTFs also will be required to review and update their emergency preparedness plans at least annually. However, under the current CoPs, PRTFs are not required to develop an emergency preparedness plan and as such, there is no requirement for an annual review of the plan. Therefore, we will analyze the burden from this requirement for all PRTFs.

Based on our experience with PRTFs, we estimate that an additional burden will be associated with reviewing the plan at least annually and we anticipate that the same staff that will be involved with developing the emergency preparedness plan will also be involved in the annual review and update of the plan. The staff would include the administrator, clinical social worker, and psychiatric registered nurse. We estimate that for each PRTF to comply with this requirement will require 4 burden hours at an estimated cost of $272. Thus, we estimate that it will require 1,508 burden hours (4 burden hours for each PRTF × 377 PRTFs) for all PRTFs to comply with this requirement at a cost of $130,288 ($272 estimated cost per PRTF × 377 PRTFs).

Section 441.184(b) will require each PRTF to develop and implement emergency preparedness policies and procedures, based on their emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). We also proposed requiring PRTFs to review and update these policies and procedures at least annually. At a minimum, we will require that the PRTF's policies and procedures address the requirements listed at § 441.184(b)(1) through (8).

Since we expect that all PRTFs already have some type of emergency plan, we also expect that all PRTFs have some emergency preparedness policies and procedures. However, we expect that all PRTFs will need to review their policies and procedures; compare them to their risk assessments, emergency preparedness plans, and communication plans they developed in accordance with § 441.183(a)(1), (a) and (c), respectively; and then revise their policies and procedures accordingly.

We expect that the administrator and a psychiatric registered nurse will be involved in reviewing and revising the policies and procedures and, if needed, developing new policies and procedures. We estimate that it will require 9 burden hours at a cost of $663 for each PRTF to comply with this requirement. Based on this estimate, it will require 3,393 burden hours (9 burden hours for each PRTF × 377 PRTFs) for all PRTFs to comply with this requirement at a cost of $249,951 ($6632 estimated cost per PRTF × 377 PRTFs).

Section 441.184(c) will require each PRTF to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. PRTFs also will have to review and update these plans at least annually. The communication plan will have to include the information set out in § 441.184(c)(1) through (7).

We expect that all PRTFs have some type of emergency preparedness communication plan. It is standard practice for healthcare facilities to maintain contact information for both staff and outside sources of assistance; alternate means of communication in case there is an interruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their residents. However, most PRTFs may not have formal, written emergency preparedness communication plans. Therefore, we expect that all PRTFs will need to review and, if needed, revise their plans.

Based on our experience with PRTFs, we anticipate that satisfying these requirements will require the involvement of the PRTF's administrator and a psychiatric registered nurse to review, revise, and if needed, develop new sections for the PRTF's emergency preparedness communication plan. We estimate that for each PRTF to comply will require 5 burden hours at a cost of $378. Based on that estimate, for all PRTFs to comply will require 1,885 burden hours (5 burden hours for each PRTF × 377 PRTFs) at a cost of $142,506 ($378 estimated cost for each PRTF × 377 PRTFs).

Section 441.184(d) will require PRTFs to develop and maintain emergency preparedness training programs and review and update those programs at least annually. Section 441.184(d)(1) will require PRTFs to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. The PRTF will also have to ensure that their staff could demonstrate knowledge of the emergency procedures. Thereafter, the PRTF will have to provide emergency preparedness training at least annually.

Based on our experience with PRTFs, we expect that all PRTFs have some type of emergency preparedness training program. However, PRTFs will need to review their current training programs and compare them to their risk assessments and emergency preparedness plans, policies and procedures, and communication plans and update and, in some cases, develop new sections for their training programs.

We expect that complying with this requirement will require the involvement of a psychiatric registered nurse. We expect that the psychiatric registered nurse will review the PRTF's current training program; determine what tasks will need to be performed and what materials will need to be developed; and develop the necessary materials. We estimate that for each PRTF to comply with the requirements in this section will require 10 burden hours at a cost of $640. Based on this estimate, for all PRTFs to comply with this requirement will require 3,770 burden hours (10 burden hours for each PRTF × 377 PRTFs) at a cost of $241,280 ($640 estimated cost for each PRTF × 377 PRTFs).

Section 441.184(d)(2) will require PRTFs to participate in a full-scale exercise at least annually. PRTFs are also required to participate in one additional testing exercise of their choice at least annually. PRTFs will also have to analyze their responses to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise their emergency plans, as needed. However, if a PRTF experienced an actual natural or man-made emergency that required activation of its emergency plan, that PRTF will be exempt from engaging in a community or a full-scale exercise for 1 year following the onset of the actual emergency event. To comply with this requirement, PRTFs will need to develop scenarios for each drill and exercise and the documentation necessary to record and analyze testing exercises and actual emergency events.

Based on our experience with PRTFs, we expect that all PRTFs have some type of emergency preparedness testing program and most, if not all, PRTFs already conduct some type of drill or exercise to test their emergency preparedness plans. We also expect that they have already developed some type of documentation for testing exercises and emergency events. However, we do not expect that all PRTFs are conducting two testing exercises annually or have developed the appropriate documentation. Thus, we will analyze the burden of these requirements for all PRTFs.

Based on our experience with PRTFs, we expect that the same individual who developed the emergency preparedness training program will develop the scenarios for the testing exercises and the accompanying documentation. We estimate that for each PRTF to comply with the requirements in this section will require 3 burden hours at a cost of $192. We estimate that for all PRTFs to comply will require 1,131 burden hours (3 burden hours for each PRTF × 377 PRTFs) at a cost of $72,384 ($192 estimated cost for each PRTF × 377 PRTFs).

Based on the previous analysis, for all 377 PRTFs to comply with the ICRs in this final rule will require 17,719 burden hours at a cost of $1,234,675.

G. ICRs Regarding Emergency Preparedness (§ 460.84)

Section 460.84(a) will require the Program for the All-Inclusive Care for the Elderly (PACE) organizations to develop and maintain emergency preparedness plans and review and update those plans at least annually. We proposed that each plan must meet the requirements listed at § 460.84(a)(1) through (4).

Section 460.84(a)(1) will require PACE organizations to develop documented, facility-based and community-based risk assessments utilizing an all-hazards approach. We believe that the performance of a risk assessment is a standard practice, and that all of the PACE organizations have already conducted some sort of risk assessment based on common emergencies the organization might encounter, such as fires, loss of power, loss of communications, etc. Therefore, we believe that each PACE organization should have already performed some sort of risk assessment.

Under the current regulations, PACE organizations are required to establish, implement, and maintain procedures for managing medical and non-medical emergencies and disasters that are likely to threaten the health or safety of the participants, staff, or the public (§ 460.72(c)(1)). The definition of “emergencies” includes natural disasters that are likely to occur in the PACE organization's area (§ 460.72(c)(2)). PACE organizations are required to plan for emergencies involving participants who are in their center(s) at the time of an emergency, as well as participants receiving services in their homes.

For the purpose of determining the burden, we will assume that a PACE organization's risk assessment, emergency plan, policies and procedures, communication plan, and training and testing program will apply to all of a PACE organization's centers. Based on the existing PACE regulations, we expect that they already assess their physical structure(s), the areas in which they are located, and the location(s) of their participants. However, these risk assessments may not be documented or address all of our requirements. Therefore, we expect that all 119 PACE organizations will have to review, revise, and update their current risk assessments.

We have not designated any specific process or format for PACE organizations to use in conducting their risk assessments because we believe that they will be able to determine the best way for their facilities to accomplish this task. However, we expect that they will include representation or input from all of their major departments. Based on our experience with PACE organizations, we expect that conducting the risk assessment will require the involvement of the PACE organization's program director, medical director, home care coordinator, quality improvement nurse, social worker, and a driver. We expect that these individuals will either attend an initial meeting or individually review relevant sections of the current risk assessment and prepare and forward their comments to the quality assurance nurse. After initial comments are received, some will attend a follow-up meeting, perform a final review, and ensure the new risk assessment was approved by the appropriate individuals. We expect that the quality improvement nurse will coordinate the meetings, review the current risk assessment, suggest revisions, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approve it. We expect that the quality improvement nurse and the home care coordinator will spend more time reviewing and developing the risk assessment than the other individuals. We estimate that complying with the requirement to conduct a risk assessment will require 14 burden hours at a cost of $1,105. For all 119 PACE organizations to comply with this requirement will require an estimated 1,666 burden hours (14 burden hours for each PACE organization × 119 PACE organizations) at a cost of $131,495 ($1,105 estimated cost for each PACE organization × 119 PACE organizations).

After conducting a risk assessment, PACE organizations will have to develop and maintain emergency preparedness plans that satisfied all of the requirements in § 460.84(a)(1) through (4). In addition to the requirement to establish, implement, and maintain procedures for managing emergencies and disasters, current regulations require PACE organizations to have a governing body or designated person responsible for developing policies on participant health and safety, including a comprehensive, systemic operational plan to ensure the health and safety of the PACE organization's participants (§ 460.62(a)(6)). We expect that an emergency preparedness plan will be an essential component of such a comprehensive, systemic operational plan. However, this regulatory requirement does not guarantee that all PACE organizations have developed a plan that complies with our requirements.

Thus, we expect that all PACE organizations will need to review their current plans and compare them to their risk assessments. PACE organizations will need to update, revise, and, in some cases, develop new sections to complete their emergency preparedness plans.

Based upon our experience with PACE organizations, we expect that the same individuals who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we expect that it will require more time to complete the plan. We expect that the quality improvement nurse will have primary responsibility for reviewing and developing the PACE organization's emergency preparedness plan. We expect that the program director, home care coordinator, and social worker will review the current plan, provide comments, and assist the quality improvement nurse in developing the final plan. Other staff members will work only on the sections of the plan that will be relevant to their areas of responsibility.

We estimate that for each PACE organization to comply with the requirement for an emergency preparedness plan will require 23 burden hours at a cost of $1,798. We estimate that for all PACE organizations to comply will require 2,737 burden hours (23 burden hours for each PACE Organization × 119 PACE organizations) at a cost of $213,962 ($1,798 estimated cost for each PACE organization × 119 PACE organizations).

The PACE organizations will also be required to review and update their emergency preparedness plans at least annually. We believe that PACE organizations are already reviewing their emergency preparedness plans periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for PACE organizations and will not be subject to the PRA in accordance with the implementing regulations of the PRA 5 CFR 1320.3(b)(2).

Section 460.84(b) will require each PACE organization to develop and implement emergency preparedness policies and procedures based on the emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). It will also require PACE organizations to review and update these policies and procedures at least annually. At a minimum, we will require that a PACE organization's policies and procedures address the requirements listed at § 460.84(b)(1) through (9).

Current regulations already require that PACE organizations establish, implement, and maintain procedures for managing emergencies and disasters (§ 460.72(c)). The definition of “emergencies” includes medical and nonmedical emergencies, such as natural disasters likely to occur in a PACE organization's area (§ 460.72(c)(2)). In addition, all PACE organizations must have a governing body or a designated person who functions as the governing body responsible for developing policies on participant health and safety (§ 460.62(a)(6)). Thus, we expect that all PACE organizations have some emergency preparedness policies and procedures. However, these requirements do not ensure that all PACE organizations have policies and procedures that will comply with our requirements.

The burden associated with the requirements will be the resources needed to review, revise, and, if needed, develop new emergency preparedness policies and procedures. We expect that the program director, home care coordinator, and quality improvement nurse will be primarily responsible for reviewing, revising, and if needed, developing any new policies and procedures needed to comply with our requirements. We estimate that for each PACE organization to comply with our requirements will require 12 burden hours at a cost of $860. Therefore, based on this estimate, for all PACE organizations to comply will require 1,428 burden hours (12 burden hours for each PACE organization × 119 PACE organizations) at a cost of $102,340 ($860 estimated cost for each PACE organization × 119 PACE organizations).

We proposed that each PACE organization must also review and update its emergency preparedness policies and procedures at least annually. We believe that PACE organizations are already reviewing their emergency preparedness policies and procedures periodically. Thus, compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 460.84(c) will require each PACE organization to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. Each PACE organization will also have to review and update this plan at least annually. The communication plan must include the information set out at § 460.84(c)(1) through (7).

All PACE organizations must have a governing body (or a designated person who functions as the governing body) that is responsible for developing policies on participant health and safety, including a comprehensive, systemic operational plan to ensure the health and safety of the PACE organization's participants (§ 460.62(a)(6)). We expect that the PACE organizations' comprehensive, systemic operational plans will include at least some of our requirements. In addition, it is standard practice in the healthcare industry to maintain contact information for both staff and outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for patients. Thus, we expect that all PACE organizations have some type of emergency preparedness communication plan. However, each PACE organization will need to review its current plan and revise or, in some cases, develop new sections to comply with our requirements.

Based on our experience with PACE organizations, we expect that the home care coordinator and the quality assurance nurse will be primarily responsible for reviewing, and if needed, revising, and developing new sections for the communication plan. We estimate that for each PACE organization to comply with the requirements will require 7 burden hours at a cost of $448. Therefore, based on this estimate, for all PACE organizations to comply with this requirement will require 833 burden hours (7 burden hours for each PACE organization × 119 PACE organizations) at a cost of $53,312 ($448 estimated cost for each PACE organization × 119 PACE organizations).

Each PACE organization must also review and update its emergency preparedness communication plan at least annually. We believe that PACE organizations are already reviewing and updating their emergency preparedness communication plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for PACE organizations and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 460.84(d) will require PACE organizations to develop and maintain emergency preparedness training and testing programs and review and update those programs at least annually. We proposed that each PACE organization will have to meet the requirements listed at § 460.84(d)(1) and (2).

Section 460.84(d)(1) will require PACE organizations to provide initial training on their emergency preparedness policies and procedures to all new and existing staff, individuals providing on-site services under arrangement, contractors, participants, and volunteers, consistent with their expected roles and maintain documentation of this training. PACE organizations will also have to ensure that their staff could demonstrate knowledge of the emergency procedures. Thereafter, PACE organizations will be required to provide this training annually.

Current regulations require PACE organizations to provide periodic orientation and appropriate training to their staffs and participants in emergency procedures (§ 460.72(c)(3)). However, these requirements do not ensure that all PACE organizations will be in compliance with our requirements. Thus, each PACE organization will need to review its current training program and compare the training program to its risk assessment, emergency preparedness plan, policies and procedures, and communication plan. The PACE organization will also need to revise and, in some cases, develop new sections to ensure that its emergency preparedness training program complied with our requirements. We expect that the quality assurance nurse will review all elements of the PACE organization's training program and determine what tasks will need to be performed and what materials will need to be developed to comply with our requirements. We expect that the home care coordinator will work with the quality assurance nurse to develop the revised and updated training program. We estimate that for each PACE organization to comply with the requirements will require 12 burden hours at a cost of $768. Therefore, it will require an estimated 1,428 burden hours (12 burden hours for each PACE organization × 119 PACE organizations) to comply with this requirement at a cost of $91,392 ($768 estimated cost for each PACE organization × 119 PACE organizations).

The PACE organizations will also be required to review and update their emergency preparedness training program at least annually. We believe that PACE organizations are already reviewing and updating their emergency preparedness training programs periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for PACE organizations and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 460.84(d)(2) will require PACE organizations to participate in a full-scale exercise at least annually. They will also be required to conduct one additional exercise of their choice at least annually. PACE organizations will also be required to analyze their responses to, and maintain documentation of, all testing exercises and any emergency events they experienced. If a PACE organization experienced an actual natural or man-made emergency that required activation of its emergency plan, it will be exempt from engaging in a community or individual, facility-based full-scale exercise for 1 year following the onset of the actual event. To comply with these requirements, PACE organizations will need to develop a specific scenario for each drill and exercise. The PACE organizations will also have to develop the documentation necessary for recording and analyzing their response to all testing exercises and emergency events.

Current regulations require each PACE organization to conduct a test of its emergency and disaster plan at least annually (42 CFR 460.72(c)(5)). They also must evaluate and document the effectiveness of their emergency and disaster plans. Thus, PACE organizations already conduct at least one test annually of their plans. We expect that as part of testing their emergency plans annually, PACE organizations will develop a scenario for and document the testing. However, this does not ensure that all PACE organizations will be in compliance with all of our requirements, especially the requirement for conducting a paper-based, tabletop exercise; performing a community-based full-scale exercise; and using different scenarios for the testing exercises.

The 119 PACE organizations will be required to develop scenarios for testing exercises and the documentation necessary to record and analyze their response to all exercises and any emergency events. Based on our experience with PACE organizations, we expect that the same individuals who developed their emergency preparedness training programs will develop the required documentation. We expect the quality improvement nurse will spend more time on these activities than the healthcare coordinator. We estimate that this activity will require 5 burden hours for each PACE organization at a cost of $320. We estimate that for all PACE organizations to comply with these requirements will require 595 burden hours (5 burden hours for each PACE organization × 119 PACE organizations) at a cost of $38,080 ($595 estimated cost for each PACE organization × 119 PACE organizations).

H. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 482.15)

Section 482.15(a) will require hospitals to develop and maintain emergency preparedness plans. We proposed that hospitals be required to review and update their emergency preparedness plans at least annually and meet the requirements set out at § 482.15(a)(1) through (4). Note that we obtain data on the number of hospitals, both accredited and non-accredited, from the CMS CASPER data system, which are updated periodically by the individual states. Due to variations in the timeliness of the data submissions, all numbers are approximate, and the number of accredited and non-accredited hospitals shown may not equal the number of hospitals at the time of this final rule's publication. In addition, some hospitals may have chosen to be accredited by more than one accrediting organization.

There are approximately 4,793 Medicare-certified hospitals. This includes 121 critical access hospitals (CAHs) that have rehabilitation or psychiatric distinct part units (DPUs) as of June 30, 2016 CASPER data. The services provided by CAH psychiatric or rehabilitation DPUs must comply with the hospital Conditions of Participation (CoPs) (42 CFR 485.647(a)). RNHCIs and CAHs that do not have DPUs have been excluded from this number and are addressed separately in this analysis. Of the 4,793 hospitals reported in CMS' CASPER data system, approximately 3,913 are accredited hospitals and the remainder are non-accredited hospitals. Three organizations have accrediting authority for these hospitals: TJC, formerly known as the Joint Commission on the Accreditation of Healthcare Organizations (JCAHO), the AOA/HFAP, and DNV GL.

Accreditation can substantially affect the burden a hospital will sustain under this final rule. The Joint Commission accredits 3,448 hospitals. Many of our requirements are similar or virtually identical to the standards, rationales, and elements of performance (EPs) required for TJC accreditation. TJC standards, rationales, and elements of performance (EPs) are on the TJC Web site at http://www.jointcommission.org/ .

The AOA/HFAP and DNV GL hospital accreditation requirements do not emphasize emergency preparedness. In addition, these hospitals account for less than 5 percent of all of the hospitals. Thus, for purposes of determining the burden, we have included the AOA/HFAP-accredited hospitals and the DNV GL-accredited hospitals in with the hospitals that are not accredited. Therefore, unless indicated otherwise, we have analyzed the burden for the 3,448 TJC-accredited hospitals separately from the remaining 1,345 non TJC-accredited hospitals (4,793 hospitals−3,448 TJC-accredited hospitals).

We have used TJC's “Comprehensive Accreditation Manual for Hospitals: The Official Handbook 2008 (CAMH)” to determine the burden for TJC-accredited hospitals. In the chapter entitled, “Management of the Environment of Care” (EC), hospitals are required to plan for managing the consequences of emergencies (CAMH, Standard EC.4.11, CAMH Refreshed Core, January 2008, p. EC-13a). Individual standards have EPs, which provide the detailed and specific performance expectations, structures, and processes for each standard (CAMH, CAMH Refreshed Core, January 2008, p. HM-6). The EPs for Standard EC.4.11 require, among other things, that hospitals conduct a hazard vulnerability analysis (HVA) (CAMH, Standard EC.4.11, EP 2, CAMH Refreshed Core, January 2008, p. EC-13a). Performing an HVA will require a hospital to identify the events that could possibly affect demand for the hospital's services or the hospital's ability to provide services. A TJC-accredited hospital also must determine the likeliness of the identified risks occurring, as well as their consequences. Thus, we expect that TJC-accredited hospitals already conduct an HVA that complies with our requirements and that any additional tasks necessary to comply will be minimal. Therefore, for TJC-accredited hospitals, the risk assessment requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 482.15(a)(1) will require that hospitals perform a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach. We expect that most non TJC-accredited hospitals have already performed at least some of the work needed for a risk assessment. The Niska and Burt article indicated that most hospitals already have plans for natural disasters. However, many may not have thoroughly documented this activity or performed as thorough a risk assessment as needed to comply with our requirements.

We have not designated any specific process or format for hospitals to use in conducting a risk assessment because we believe that hospitals need the flexibility to determine how best to accomplish this task. However, we expect that hospitals will obtain input from all of their major departments when performing a risk assessment. Based on our experience, we expect that conducting a risk assessment will require the involvement of at least a hospital administrator, the risk management director, the chief medical officer, the chief of surgery, the director of nursing, the pharmacy director, the facilities director, the health information services director, the safety director, the security manager, the community relations manager, the food services director, and administrative support staff. We expect that most of these individuals will attend an initial meeting, review relevant sections of their current risk assessment, prepare and send their comments to the risk management director, attend a follow-up meeting, perform a final review, and approve the new risk assessment.

We expect that the risk management director will coordinate the meetings, review and comment on the current risk assessment, suggest revisions, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approve it. We expect that the hospital administrator will spend more time reviewing the risk assessment than most of the other individuals.

We estimate that the risk assessment will require 34 burden hours to complete at a cost of $4,232 for each non-TJC accredited hospital. There are approximately 1,345 non TJC-accredited hospitals. Therefore, it will require an estimated 45,730 burden hours (34 burden hours for each non TJC-accredited hospitals × 1,345 non TJC-accredited hospitals) for all non TJC-accredited hospitals to comply at a cost of $5,692,040 ($4,232 estimated cost for each non TJC-hospital × 1,345 non TJC-accredited hospitals).

Section 482.15(a)(1) through (4) will require hospitals to develop and maintain emergency preparedness plans. We expect that all hospitals will compare their risk assessments to their emergency plans and revise and, if necessary, develop new sections for their plans. TJC-accredited hospitals must develop and maintain written Emergency Operations Plans (EOPs) (CAMH, Standard EC.4.12, EP 1, CAMH Refreshed Care, January 2008, p. EC-13b). The EOP should describe an “all-hazards” approach to coordinating six critical areas: Communications, resources and assets, safety and security, staff roles and responsibilities, utilities, and patient clinical and support activities during emergencies (CAMH, Standard EC.4.13-EC.4.18, CAMH Refreshed Core, January 2008, pp. EC-13b-EC-13g). Hospitals also must include in their EOP “[r]esponse strategies and actions to be activated during the emergency” and “[r]ecovery strategies and actions designed to help restore the systems that are critical to resuming normal care, treatment and services” (CAMH, Standard EC.4.11, EPs 7 and 8, p. EC-13a). In addition, hospitals are required to have plans to manage “clinical services for vulnerable populations served by the hospital, including patients who are pediatric, geriatric, disabled or have serious chronic conditions or addictions” (CAMH, Standard EC.4.18, EP 2, p. EC-13g). Hospitals also must plan how to manage the mental health needs of their patients (CAMH, Standard EC.4.18, EP 4, EC-13g). Thus, we expect that TJC-accredited hospitals have already developed and are maintaining EOPs that comply with the requirement for an emergency plan in this final rule. If a TJC-accredited hospital needed to complete additional tasks to comply with the requirement, we believe that the burden will be negligible. Therefore, for TJC-accredited hospitals, this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

We expect that most, if not all, non TJC-accredited hospitals already have some type of emergency preparedness plan. The Niska and Burt article noted that the majority of hospitals have plans for natural disasters; incendiary incidents; and biological, chemical, and radiological terrorism. In addition, all hospitals must already meet the requirements set out at 42 CFR 482.41, including emergency power, lighting, gas and water supply requirements as well as specified Life Safety Code provisions. However, those existing plans may not be fully compliant with our requirements. Thus, it will be necessary for non TJC-accredited hospitals to review their current plans and compare them to their risk assessments and revise, update, or, in some cases, develop new sections for their emergency plans.

Based on our experience with hospitals, we expect that the same individuals who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we estimate that it will require substantially more time to complete an emergency preparedness plan. We estimate that complying with this requirement will require 62 burden hours at a cost of $7,408 for each non TJC-accredited hospital. There are approximately 1,345 non TJC-accredited hospitals. Therefore, based on this estimate, it will require 83,390 burden hours for all non TJC-accredited hospitals (62 burden hours for each non TJC-accredited hospitals × 1,345 non TJC-accredited hospitals) to complete an emergency preparedness plan at a cost of $9,963,760 ($7,408 estimated cost for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals).

Under this final rule, a hospital also will be required to review and update its emergency preparedness plan at least annually. We believe that hospitals already review their emergency preparedness plans periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for hospitals and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Under § 482.15(b), we will require each hospital to develop and implement emergency preparedness policies and procedures based on its emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). We will also require hospitals to review and update these policies and procedures at least annually. At a minimum, we will require that the policies and procedures address the requirements at § 482.15(b)(1) through (8).

We will expect all hospitals to review their emergency preparedness policies and procedures and compare them to their emergency plans, risk assessments, and communication plans. We expect that hospitals will then review, revise, and, if necessary, develop new policies and procedures that comply with our requirements.

The CAMH's chapter entitled, “Leadership” (LD), requires TJC-accredited hospital leaders to “develop policies and procedures that guide and support patient care, treatment, and services.” The policies and procedures are to guide all patient care, including during and after emergencies (CAMH, Standard LC.3.90, EP 1, CAMH Refreshed Core, January 2008, p. LD-15). Thus, we expect that TJC-accredited hospitals already have some policies and procedures related to our requirements. In addition to meeting TJC standards, hospitals are required to meet state and local and licensing requirements. Based on these requirements, hospitals have been operating within this framework in the delivery of patient care services. State and local laws require fire, emergency, and safety codes that have an impact on operations during an emergency or a disaster. As discussed later, many of the requirements in § 482.15(b) has a corresponding requirement in the TJC hospital accreditation standards. Hence, we will discuss each section individually.

Section 482.15(b)(1) will require hospitals to have policies and procedures for the provision of subsistence needs for staff and patients, whether they evacuate or shelter in place. TJC-accredited hospitals are required to make plans for obtaining and replenishing medical and non-medical supplies, including food, water, and fuel for generators and transportation vehicles (CAMH, Standard EC.4.14, EPs 1-8 and 10-11, p. EC-13d). In addition, hospitals must identify alternative means of providing electricity, water, fuel, and other essential utility needs in cases when their usual supply is disrupted or compromised (CAMH, Standard EC.4.17, EPs 1-5, p. EC-13f). Thus, we expect that TJC-accredited hospitals will be in compliance with our provision of subsistence requirements in § 482.15(b)(1).

Section 482.15(b)(2) will require hospitals to have policies and procedures to track the location of on-duty staff and sheltered patients in the hospital's care during an emergency. TJC-accredited hospitals must plan for communicating with patients and their families at the beginning of and during an emergency (CAMH, Standard EC.4.13, EPs 1, 2, and 5, p. EC-13c). We expect that TJC-accredited hospitals will be in compliance with § 482.15(b)(2).

Section 482.15(b)(3) will require hospitals to have policies and procedures for a plan for the safe evacuation from the hospital. TJC-accredited hospitals are required to make plans to evacuate patients as part of managing their clinical activities (CAMH, Standard EC.4.18, EP 1, p. EC-13g). They also must plan for the evacuation and transport of patients, as well as their information, medications, supplies, and equipment, to alternative care sites (ACSs) when the hospital cannot provide care, treatment, and services in their facility (CAMH, Standard EC.4.14, EPs 9-11, p. EC-13d). Section 482.15(b)(3) also will require hospitals to have “primary and alternate means of communication with external sources of assistance.” TJC-accredited hospitals must plan for communicating with external authorities once the hospital initiates its emergency response measures (CAMH, Standard EC.4.13, EP 4, p. EC-13c). Thus, TJC-accredited hospitals will be in compliance with most of the requirements in § 482.15(b)(3). However, we do not believe these requirements will ensure compliance with the requirement that the hospital establish policies and procedures for staff responsibilities.

Section 482.15(b)(4) will require hospitals to have policies and procedures that address a means to shelter in place for patients, staff, and volunteers who remain at the facility. The rationale for CAMH Standard EC.4.18 states, “a catastrophic emergency may result in the decision to keep all patients on the premises in the interest of safety” (CAMH, Standard EC.4.18, p. EC-13f). We expect that TJC-accredited hospitals will be in compliance with our shelter in place requirement in § 482.15(b)(4).

Section 482.15(b)(5) will require hospitals to have policies and procedures that address a system of medical documentation that preserves patient information, protects the confidentiality of patient information, and ensures that records are secure and readily available. The CAMH chapter entitled “Management of Information” requires TJC-accredited hospitals to have storage and retrieval systems for their clinical/service and hospital-specific information (CAMH, Standard IM.3.10, EP 5, CAMH Refreshed Core, January 2008, p. IM-10) and to ensure the continuity of their critical information “needs for patient care, treatment, and services (CAMH, Standard IM.2.30, Rationale for IM.2.30, CAMH Refreshed Core, January 2008, p. IM-8). They also must ensure the privacy and confidentiality of patient information (CAMH, Standard IM.2.10, CAMH Refreshed Core, January 2008, p. IM-7) and have plans for transporting and tracking patients' clinical information, including transferring information to ACSs (CAMH Standard EC.4.14, EP 11, p. EC-13d and Standard EC.4.18, EP 6, pp. EC-13d and EC-13g, respectively). Therefore, we expect that TJC-accredited hospitals will be in compliance with the requirements we proposed in § 482.15(b)(5).

Section 482.15(b)(6) will require hospitals to have policies and procedures that address the use of volunteers in an emergency or other emergency staffing strategies, including the process and role for integration of state and federally-designated healthcare professionals to address surge needs during an emergency. TJC-accredited hospitals must already define staff roles and responsibilities in their EOPs and ensure that they train their staffs for their assigned roles (CAMH, Standard EC.4.16, EPs 1 and 2, p. EC-13e). The rationale for Standard EC.4.15 indicates that the “hospital determines the type of access and movement to be allowed by . . . emergency volunteers . . . when emergency measures are initiated.” In addition, in the chapter entitled “Medical Staff” (MS), hospitals “may grant disaster privileges to volunteers that are eligible to be licensed independent practitioners” (CAMH, Standard MS.4.110, CAMH Refreshed Care, January 2008, p. MS-27). Finally, in the chapter entitled “Management of Human Resources” (HR), hospitals “may assign disaster responsibilities to volunteer practitioners” (CAMH, Standard HR.1.25, CAMH Refreshed Core, January 2008, p. HR-5). Although TJC accreditation requirements partially address our requirements, we do not believe these requirements will ensure compliance with all requirements in in § 482.15(b)(6).

Section 482.15(b)(7) will require hospitals to have policies and procedures that will address the development of arrangements with other hospitals or other providers to receive patients in the event of limitations or cessation of operations to ensure continuity of services to hospital patients. TJC-accredited hospitals must plan for the sharing of resources and assets with other healthcare organizations (CAMH, Standard EC.4.14, EPs 7 and 8, p. EC-13d). However, we will not expect TJC-accredited hospitals to be substantially in compliance with the requirements we proposed in § 482.15(b)(7) based on compliance with TJC accreditation standards alone.

Section 482.15(b)(8) will require hospitals to have policies and procedures that address the hospital's role under an “1135 waiver” (that is, a waiver of some federal rules in accordance with § 1135 of the Social Security Act) in the provision of care and treatment at an ACS identified by emergency management officials. TJC-accredited hospitals must already have plans for transporting patients, as well as their associated information, medications, equipment, and staff to ACSs when the hospital cannot support their care, treatment, and services on site (CAMH, Standard EC.4.14, EPs 10 and 11, p. EC-13d). We expect that TJC-accredited hospitals will be in compliance with the requirements we proposed in § 482.15(b)(8).

In summary, we expect that TJC-accredited hospitals have developed and are maintaining policies and procedures that will comply with the requirements in § 482.15(b), except for § 482.15(b)(3), (6), and (7). Later we will discuss the burden on TJC-accredited hospitals with respect to these provisions. We expect that any modifications that TJC-accredited hospitals will need to make to comply with the remaining requirements will not impose a burden above that incurred as part of usual and customary business practices. Thus, with the exception of the requirements set out at § 482.15(b)(3), (6), and (7), we believe the requirements constitute usual and customary business practices and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

The burden associated with § 482.15(b)(3), (6), and (7) will be the resources required to develop written policies and procedures that comply with the requirements. We expect that the risk management director will review the hospital's policies and procedures initially and make recommendations for revisions and development of additional policies or procedures. We expect that representatives from the hospital's major departments will make revisions or draft new policies and procedures based on the administrator's recommendation. The appropriate parties will then need to compile and disseminate these new policies and procedures. We estimate that complying with these requirements will require 17 burden hours for each TJC-accredited hospital at a cost of $2,061. For all 3,448 TJC-accredited hospitals to comply with these requirements will require an estimated 58,616 burden hours (17 burden hours for each TJC-accredited hospital × 3,448 TJC-accredited hospitals) at a cost of $7,106,328 ($2,061 estimated cost for each TJC-accredited hospital × 3,448 TJC-accredited hospitals).

The 1,345 non TJC-accredited hospitals will need to review their policies and procedures, ensure that their policies and procedures accurately reflect their risk assessments, emergency preparedness plans, and communication plans, and incorporate any of our requirements into their policies and procedures. We expect that the risk management director will coordinate the meetings, review and comment on the current policies and procedures, suggest revisions, coordinate comments, develop the policies and procedures, and ensure that the necessary parties approve it. We expect that the hospital administrator will spend more time reviewing the policies and procedures than most of the other individuals.

We estimate that complying with this requirement will require 33 burden hours for each non TJC-accredited hospital at an estimated cost of $3,831. Based on this estimate, for all 1,345 non TJC-accredited hospitals to comply with these requirements will require 44,385 burden hours (33 burden hours for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals) at a cost of $5,152,695 ($3,831 estimated cost for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals).

In addition, we expect that there will be a burden as a result of § 482.15(b)(7). Section 482.15(b)(7) will require hospitals to develop and maintain policies and procedures that address a hospital's development of arrangements with other hospitals and other providers to receive patients in the event of limitations or cessation of operations to ensure continuity of services to hospital patients. We expect that hospitals will base those arrangements on written agreements between the hospital and other hospitals and other providers. Thus, in addition to the burden related to developing the policies and procedures, hospitals will also sustain a burden related to developing the written agreements related to those arrangements.

All 4,793 hospitals will need to identify other hospitals and other providers with which they could have agreements, negotiate and draft the agreements, and obtain all necessary authorizations for the agreements. For the purpose of determining the burden, we will assume that hospitals will have written agreements with two other hospitals and other providers. Based on our experience with hospitals, we expect that complying with this requirement will primarily require the involvement of the hospital's administrator and risk management director. We also expect that a hospital attorney will assist with drafting the agreements and reviewing those documents for any legal implications. We estimate that complying with this requirement will require 8 burden hours for each hospital at an estimated cost of $1,037. Thus, it will require an estimated 38,344 burden hours (8 burden hours for each hospital × 4,793 hospitals) for all hospitals to comply with this requirement at a cost of $4,970,341 ($1,037 estimated cost for each hospital × 4,793 hospitals).

Section 482.15(b) will also require hospitals to review and update their emergency preparedness policies and procedures at least annually. We believe hospitals are already reviewing and updating their emergency preparedness policies and procedures periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for both TJC-accredited and non TJC-accredited hospitals and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Section 482.15(c) will require each hospital to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. The plan will have to be reviewed and updated at least annually. The communication plan will have to include the information listed at § 482.15(c)(1) through (7).

We expect that all hospitals currently have some type of emergency preparedness communication plan. We expect that under this final rule, hospitals will review their current communication plans, compare them to their emergency preparedness plans and emergency policies and procedures, and revise their communication plans, as necessary. It is standard practice for healthcare facilities to maintain contact information for staff and outside sources of assistance; have alternate means of communication in case there is an interruption in phone service to the facility; and have a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for patients. However, under this final rule, all hospitals will need to review and update their plans to ensure compliance with our requirements.

TJC-accredited hospitals are required to establish emergency communication strategies (CAMH, Standard EC.4.13, p. EC-13b). In addition, TJC-accredited hospitals are specifically required to ensure communication with staff, external authorities, patients, and their families (CAMH, Standard EC.4.13, EPs 1-5, p. EC-13c). TJC-accredited hospitals also are required to establish “back-up communications systems and technologies” for such activities (CAMH, Standard EC.4.13, EP 14, p. EC-13c). Moreover, TJC-accredited hospitals are required specifically to define “the circumstances and plans for communicating information about patients to third parties (such as other healthcare organizations) . . .” (CAMH, Standard EC.4.13, EP 12, p. EC-13c). Thus, we expect that that TJC-accredited hospitals will be in compliance with § 482.15(c)(1) through (4). In addition, the rationale for EC.4.13 states, “the hospital maintains reliable surveillance and communications capability to detect emergencies and communicate response efforts to hospital response personnel, patient and their families, and external agencies (CAMH, Standard EC.4.13, pp. EC-13b—13c). We expect that most, if not all, TJC-accredited hospitals will be in compliance with § 482.15(c)(5) through (7). Therefore, we expect that TJC-accredited hospitals already have developed and are currently maintaining emergency communication plans that will satisfy the requirements contained in § 482.15(c). Therefore, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Most, if not all, non TJC-accredited hospitals will be substantially in compliance with § 482.15(c)(1) through (4). However, non TJC-accredited hospitals will need to review, update, and in some cases, develop new sections for their emergency communication plans to ensure they are in compliance with all of the requirements in this section. We expect that this activity will require the involvement of the hospital's administrator, the risk management director, the facilities director, the health information services director, the security manager, and administrative support staff. We estimate that complying with this requirement will require 10 burden hours at a cost of $1,111 for each of the 1,345 non TJC-accredited hospitals. Therefore, based on this estimate, for non TJC-accredited hospitals to comply with this requirement will require 13,450 burden hours (10 burden hours for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals) at a cost of $1,494,295 ($1,068 estimated cost for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals).

Section 482.15(c) also will require hospitals to review and update their emergency preparedness communication plans at least annually. We believe that hospitals are already reviewing and updating their emergency preparedness communication plans periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 482.15(d) will require hospitals to develop and maintain emergency preparedness training and testing programs and review and update those plans at least annually. The hospital will be required to meet the requirements in § 482.15(d)(1) and (2).

Section 482.15(d)(1) will require hospitals to provide initial and thereafter annual training on their emergency preparedness policies and procedures to all and new existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles. Hospitals must also maintain documentation of all of this training.

The burden for § 482.15(d)(1) will be the time and effort necessary to develop a training program and the materials needed for the required initial and annual training. We expect that all hospitals will review their current training programs and compare them to their risk assessments, emergency plans, policies and procedures, and communication plans as set forth in § 482.15(a)(1), (a), (b), and (c), respectively. Hospitals will need to revise and, if necessary, develop new sections or material to ensure that their training programs comply with our requirements.

TJC-accredited hospitals are required to define staff roles and responsibilities in their EOP and train their staff for their assigned roles during emergencies (CAMH, EC.4.16, EPs 1-2, p. EC-13e). In addition, the TJC-accredited hospitals are required to provide an initial orientation, which includes information that the hospital has determined are key elements the staff need before they provide care, treatment, or services to patients (CAMH, Standard HR.2.10, EPs 1-2, CAMH Refreshed Core, January 2008, p. HR-10). We will expect that an orientation to the hospital's EOP will be part of this initial training. TJC-accredited hospitals also must provide on-going training to their staff, including training on specific job-related safety (CAMH, Standard HR-2.30, EP 4, CAMH Refreshed Core, January 2008, p. HR-11), and we expect that emergency preparedness is part of such on-going training.

Although TJC requirements do not specifically address training for individuals providing services under arrangement or training for volunteers consistent with their expected roles, it is standard practice for healthcare facilities to provide some type of training to all personnel, including those providing services under contract or arrangement and volunteers. If a hospital does not already provide such training, we will expect the additional burden to be negligible. Thus, for the TJC-accredited hospitals, the requirements will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Based on our experience with non TJC-accredited hospitals, we expect that the non TJC-accredited hospitals have some type of emergency preparedness training program and provide training to their staff regarding their duties and responsibilities under their emergency plans. However, under this final rule, non TJC-accredited hospitals will need to compare their existing training programs with their risk assessments, emergency preparedness plans, policies and procedures, and communication plans. They also will need to revise, update, and, if necessary, develop new sections and new material for their training programs.

There are many ways in which a hospital may develop a training program. For example, to develop their training programs, hospitals could draw upon the resources of federal, state, and local emergency preparedness agencies, as well as state and national healthcare associations and organizations. Hospitals could also participate in a local healthcare coalition, a partnership with other hospitals, healthcare facilities and local health departments to develop the necessary training. In addition, hospitals could develop partnerships with other hospitals and healthcare facilities to develop the necessary training. Some hospitals might also choose to purchase off-the-shelf emergency training programs or hire consultants to develop the programs for them. However, because many hospitals have a hospital emergency manager and safety office, we anticipate that the training program would likely be developed using the hospital's own staff. It is our experience with hospitals that a majority of them conduct some type of preparedness activities and training and, as such, are most likely to have staff versed in these issues that can assist with training. Additionally, hospitals and other healthcare providers commonly participate in trainings that are provided by their local healthcare coalition, local and state public health and emergency management agencies conducting community based exercises (for example, American Red Cross). The estimation of a burden for these requirements is based on this assumption.

Based on our experience with hospitals, we expect that complying with this requirement will require the involvement of the hospital administrator, the risk management director, a healthcare trainer, and administrative support staff. We estimate that it will require 40 burden hours for each hospital to develop an emergency preparedness training program at a cost of $3,000 for each non TJC-accredited hospital. We estimate that it will require 53,800 burden hours (40 burden hours for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals) to comply with this requirement at a cost of $4,035,000 ($3,000 estimated cost for each hospital × 1,345 non TJC-accredited hospitals).

Section 482.15(d) will also require hospitals to review and update their emergency preparedness training program at least annually. We believe that hospitals are already reviewing and updating their emergency preparedness training programs periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Hospitals also will be required to maintain documentation of their training. Based on our experience, we believe it is standard practice for hospitals to document the training they provide to their staff, individuals providing services under arrangement, and volunteers. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for the hospitals and not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 482.15(d)(2) will also require hospitals to participate in a full-scale exercise and one additional exercise of their choice at least annually. Hospitals also will be required to analyze their responses to, and maintain documentation of, all exercises and emergency events. If a hospital experienced an actual emergency which required activation of its emergency plan, it will be exempt from the requirement for a community or individual, facility-based disaster drill for 1 year following the onset of the emergency (§ 482.15(d)(2)(ii)). Thus, to satisfy the burden for these requirements, hospitals will need to develop a scenario for each exercise, as well as the documentation necessary for recording what happened. If a hospital participated in a full-scale exercise, it probably will not need to develop a scenario for that drill. However, for the purpose of determining the burden, we will assume that hospitals will need to develop at least two scenarios annually, one for each testing exercise requirement.

TJC-accredited hospitals are required to test their EOP twice a year (CAMH, Standard EC.4.20, EP 1, p. EC-14a). In addition, TJC-accredited hospitals must analyze all exercises, identify deficiencies and areas for improvement, and modify their EOPs in response to the analysis of those tests (CAMH, Standard EC.4.20, EPs 15-17, p. EC-14b). Therefore, we expect that TJC-accredited hospitals have already developed scenarios for testing exercises and have the documentation needed for the analysis of their responses. We expect that it will be a usual and customary business practice for the TJC-accredited hospitals to comply with the requirement to prepare scenarios for emergency preparedness testing exercises and to develop the necessary documentation. Thus, we believe compliance with this requirement will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Based on our experience with non TJC-accredited hospitals, we expect that the remaining non TJC-accredited hospitals have some type of emergency preparedness training program and that most, if not all, of them already conduct some type of drill or exercise to test their emergency preparedness plans. In addition, many hospitals participate in drills and exercises held by their communities, counties, and states. A 2006 study of 678 hospitals found that 88 percent of the participating hospitals were engaged in community-wide emergency preparedness drills and exercises (Braun BI, Wineman NV, Finn NL, Barbera JA, Schmaltz SP, Loeb JM. Integrating hospitals into community emergency preparedness planning. Ann Intern Med. 2006 Jun;144(11):799-811. PubMed PMID: 16754922.) We also expect that many of these hospitals have already developed the required documentation for recording the events, and analyzing their responses to, their testing exercises and emergency events. However, we do not believe that all non-TJC accredited hospitals will be in compliance with our requirements. Thus, we will analyze the burden for non TJC-accredited hospitals.

The non TJC-accredited hospitals will be required to develop scenarios for the testing exercises and the documentation necessary to record and analyze their responses to the exercises and emergency events. Based on our experience with hospitals, we expect that the same individuals who developed the emergency preparedness training program will develop the scenarios for the testing exercises and the accompanying documentation. We expect that the healthcare trainer will spend more time developing the scenarios and documentation. Thus, for each of the 1,345 non TJC-accredited hospitals to comply with these requirements, we estimate that it will require 9 burden hours at a cost of $752. Based on this estimate, for all 1,345 non TJC-accredited hospitals to comply will require 12,105 burden hours (9 burden hours for each non TJC-accredited hospital × 1,345 non TJC-accredited hospitals) at a cost of $1,011,440 ($752 estimated cost for each non TJC-accredited hospital × 1,345 non TJC-accredited hospital).

I. ICRs Regarding Condition of Participation: Emergency Preparedness for Transplant Centers (§ 482.78)

As discussed in section II.I. of this final rule, we have revised our requirements for transplant centers. Section 482.78 will require that transplant programs be included in the emergency preparedness planning and the emergency preparedness program for the hospital in which it is located. We note that a transplant center is not individually responsible for the emergency preparedness requirements set forth in § 482.15, except as detailed. Section 482.78(a) will require transplant centers to have policies and procedures that address emergency preparedness. Section 482.78(b) will require transplant centers to develop and maintain mutually-agreed upon protocols that address the duties and responsibilities of the transplant center, the hospital in which the transplant center is located, and the OPO during an emergency.

All of the Medicare-approved transplant centers are located within hospitals and, as part of the hospital, should be included in the hospital's emergency preparedness plans. We expect that since transplants are part of the hospital, they are usually involved in the hospital's programs as part of their normal business practices. Thus, compliance with these requirements will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). We refer readers to the discussion in section H above regarding the burden estimate for hospitals.

J. ICRs Regarding Emergency Preparedness (§ 483.73)

1. Discussion of Omnibus Budget Reconciliation Act of 1987 Waiver

Section 483.73 sets forth the emergency preparedness requirements for long term care (LTC) facilities. We would usually be required to estimate the information collection requirements (ICRs) for these requirements in accordance with chapter 35 of title 44, United States Code. However, sections 4204(b) and 4214(d), which cover skilled nursing facilities (SNFs) and nursing facilities (NFs), respectively, of the Omnibus Budget Reconciliation Act of 1987 (OBRA '87) provide for a waiver of PRA requirements for the regulations that implement the OBRA '87 requirements. Section 1819(d) of the Act, as implemented by section 4201 of OBRA '87, requires that SNFs “be administered in a manner that enables it to use its resources effectively and efficiently to attain or maintain the highest practicable physical, mental, and psychosocial well-being of each resident (consistent with requirements established under subsection (f)(5)).” Section 1819(f)(5)(C) of the Act, requires the Secretary to establish criteria for assessing a SNF's compliance with the requirement in subsection (d) with respect for disaster preparedness. Nursing facilities have the same requirement in sections 1919(d) and (f)(5)(C) of the Act, as implemented by OBRA '87.

All of the requirements in this rule relate to disaster preparedness. We believe this waiver applies to those revisions we have made to existing requirements in part 483, subpart B. Thus, the ICRs for the requirements in § 483.73 are not subject to the PRA. However, the waiver does not apply to the requirements of Executive Orders 12866 and 13563 under the Regulatory Impact Analysis (RIA) section. Therefore, to provide readers with sufficient context regarding the RIA discussion of the estimated costs to LTC facilities associated with this final rule, we have provided a discussion of the ICRs for LTC facilities in this COI section. We note that the estimates discussed in this section are not included in Table 128 “Total Burden Hour Estimates for All Providers and Suppliers to Comply with the ICRs Contained in the Final Rule: Emergency Preparedness”, per the wavier discussed previously. Emergency preparedness plan that must be reviewed and updated at least annually. The plan will have to meet the requirements set out at § 483.73(a)(1) through (4).

Section 483.73(a)(1) requires LTC facilities to develop documented, facility-based and community-based-risk assessments utilizing an all-hazards approach. We expect that all LTC facilities will need to identify the medical and non-medical emergency events they could experience in their facilities themselves and the communities in which they are located. We expect that in performing a risk assessment, a LTC facility will need to consider its physical location, the geographic area in which it is located, and its resident population.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment that complies with the requirements of this final rule. Existing requirements for LTC facilities already mandate that LTC facilities have “detailed written plans and procedures to meet all potential emergencies and disasters, such as fire, severe weather, and missing residents” (see existing § 483.75(m)(1)). We expect that all LTC facilities already have performed some type of risk assessment during the process of developing their emergency and/or disaster plans and procedures. However, these risk assessments may not be as thorough as we require in this final rule, nor address all of the elements required by § 483.73(a)(1). With the exception of severe weather, the existing requirements at § 483.75(m)(1) discussed previously address emergencies and disasters that primarily arise within, or closely surrounding, a LTC facility. In addition, the existing regulations do not specifically require LTC facilities to plan for man-made disasters. Therefore, we expect that under this final rule, all LTC facilities will need to conduct a review of their current risk assessments and then perform the necessary tasks to ensure that their risk assessments comply with the requirements.

We have not identified any specific process or format for LTC facilities to use in conducting their risk assessments because we believe that they need maximum flexibility in determining the best way for their facilities to accomplish this task. However, we expect that in the process of developing a risk assessment, healthcare institutions should include representatives from, or obtain input from, all of their major departments. Based on our experience with LTC facilities, we expect that reviewing, revising, and updating a facility's existing risk assessment will require the involvement of the LTC facility's administrator, director of nursing, and the facilities director. We expect that these individuals will attend an initial meeting, review relevant sections of the previous assessment, if any, develop comments and recommendations, attend a follow-up meeting, perform a final review along with the administrator, and approve the new risk assessment.

In addition, we expect that the administrator will likely coordinate the meetings, perform an initial review of the current risk assessment, provide a critique of the risk assessment, offer suggested revisions, coordinate comments, develop a new risk assessment, and ensure that the necessary parties approve the new risk assessment. Therefore, we expect that the administrator will spend more time than the other participants working on the risk assessment.

We estimate that complying with this requirement will require 8 burden hours at a cost of $692. There are 15,699 LTC facilities in the United States. Therefore, it will require an estimated 125,592 burden hours (8 burden hours for each LTC facility × 15,699 LTC facilities) for all LTC facilities to comply with this requirement at a cost of $10,863,708 ($692 estimated cost for each LTC facility × 15,699 LTC facilities).

After conducting the risk assessment, each LTC facility will then have to develop and maintain an emergency preparedness plan that addresses the requirements in § 483.73(a)(1)-(4) and review and update this plan at least annually. Existing requirements for LTC facilities require them to have “detailed written plans and procedures to meet all potential emergencies and disasters” (see existing § 483.75(m)(1)). We expect all LTC facilities already have some type of emergency preparedness and/or disaster plan. However, as discussed previously, we expect these plans and procedures will primarily cover disasters and emergencies that will affect the facilities themselves and, with the exception of severe weather, not necessarily the communities in which they are located. We also expect that all LTC facilities will need to review their current plans, compare them to their revised risk assessments, and update, revise, and, if necessary, develop new sections for their plans to ensure their emergency plans address the risks identified in their risk assessments and the specific elements we are issuing in this final rule.

The burden associated with this requirement will be the resources needed to review, revise, and, if needed, develop new sections for the LTC facility's existing emergency plan. Based upon our experience with LTC facilities, we expect that the same individuals who were involved in the risk assessment will be involved in these activities. We also expect these tasks will require more time to complete than the risk assessment.

We expect that the administrator, director of nursing, and the facilities director will have to attend an initial meeting, review the facility's current emergency preparedness plan, develop comments and recommendations, attend a follow-up meeting, perform a final review, and approve the new emergency preparedness plan. We expect that the administrator will develop the emergency preparedness plan and ensure that the necessary parties approved it. We also expect that the administrator will spend more time than the other participants reviewing and working on the emergency preparedness plan.

We estimate that complying with this requirement will require 12 burden hours at a cost of $1,038 for each LTC facility. There are 15,699 LTC facilities. Therefore, it will require an estimated 188,388 burden hours (12 burden hours for each LTC facility × 15,699 LTC facilities) to complete the plan at a cost of $ ($1,038 estimated cost for each LTC facility × 15,699 LTC facilities).

We require LTC facilities to review and update their emergency preparedness plans at least annually. The current emergency preparedness requirements for LTC facilities mandate that they “periodically review the procedures with their existing staff” (§ 483.75(m)(2)). We also expect that all LTC facilities will review and update their emergency preparedness plans annually. Thus, compliance with this requirement will constitute a usual and customary business practice for LTC facilities and will not be subject to the PRA in accordance with 5 CFR 1320.3(b)(2).

Section 483.73(b) requires each LTC facility to develop and maintain emergency preparedness policies and procedures based on their emergency preparedness plan, risk assessment, and communication plan as set forth at § 483.73(a), (a)(1), and (c), respectively. LTC facilities are also required to review and update these policies and procedures at least annually. These policies and procedures will have to address, at a minimum, the requirements set forth at § 483.73(b)(1) through (8).

We expect that all LTC facilities have some emergency preparedness policies and procedures in place because existing regulations require them to have written disaster and emergency preparedness plans and procedures that address all potential disasters and emergencies (see exiting § 483.75(m)(1)). However, under this final rule, all LTC facilities will need to review their policies and procedures, assess whether their policies and procedures incorporate all the elements of their emergency preparedness plan, and if necessary, take the appropriate steps to ensure that their policies and procedures encompass the requirements in this final rule.

The burden associated with these requirements will be the time and effort necessary to review, revise, and, if necessary, develop new emergency policies and procedures. We expect that the administrator, the director of nursing, and the facilities director will be involved with reviewing, revising, and, if needed, developing any new policies and procedures. The administrator will brief any other staff and create assignments for purposes of making necessary revisions or drafting new policies and procedures and disseminate them to the appropriate parties. We estimate that complying with this requirement will require 10 burden hours at a cost of $868. Therefore, for all LTC facilities to comply with this requirement will require an estimated 156,990 burden hours (10 burden hours for each LTC facility × 15,699 LTC facilities) at a cost of $13,626,732 ($868 estimated cost for each LTC facility × 15,699 LTC facilities).

LTC facilities will be required to review and update their emergency preparedness policies and procedures at least annually. We believe that LTC facilities already review their policies and procedures periodically. Hence, these activities will constitute a usual and customary business practice for LTC facilities and will not be subject to the PRA in accordance with 5 CFR 1320.3(b)(2).

Section 483.73(c) will require each LTC facility to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. The LTC facility will also have to review and update its plan at least annually. The communication plan will have to include the information listed in § 483.73(c)(1) through (7).

We expect that all LTC facilities will compare their current emergency preparedness communications plans, if they have one, to these requirements. The LTC facilities will then need to perform any tasks necessary to ensure that their communication plans were documented and in compliance with these requirements.

We expect that all LTC facilities will have some type of emergency preparedness communication plan. Existing requirements for LTC facilities already require them to have written disaster plans and procedures (see existing § 483.75(m)(1)). Since the ability to communicate with staff, residents' families, and external sources of assistance during an emergency is critical for all healthcare organizations, we believe that communication will be an integral part of any LTC facility's disaster plan. In addition, it is standard practice for healthcare organizations to maintain contact information for their staff and for outside sources of assistance; alternate means of communications in case there is a disruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their residents. Thus, we expect that all LTC facilities already comply with the requirements of § 483.73(c)(1) through (3). However, we also expect that many LTC facilities may not have formal, written emergency preparedness communication plans or their plans may not be in compliance with the elements required in § 483.73(c)(4) through (7). Therefore, we expect that under this final rule, all LTC facilities will need to review, update, and in some cases, develop new sections for their emergency communication plans, to ensure those plans include all of these elements.

The burden associated with complying with this requirement will be the resources needed to review, update, and, if necessary, develop new sections for the LTC facility's existing communication plans. Based upon our experience with LTC facilities, we expect that satisfying the requirements of this section will require the involvement of the LTC facility's administrator and the director of nursing. We estimate that complying with this requirement will require 6 burden hours for each facility at a cost of $510. For all LTC facilities to comply with this requirement will require an estimated 94,194 burden hours (6 burden hours for each LTC facility × 15,699 LTC facilities) at a cost of $8,006,490 ($510 estimated cost for each LTC facility × 15,699 LTC facilities).

LTC facilities will also have to review and update its emergency preparedness communication plan at least annually. We believe that LTC facilities already review and update their plans and procedures periodically. Thus, the requirement for an annual review of the emergency preparedness communications plan constitutes a usual and customary business practice for LTC facilities and will not be subject to the PRA in accordance with 5 CFR 1320.3(b)(2).

Section 483.73(d) will require LTC facilities to develop and maintain emergency preparedness training and testing programs. These training and testing programs will have to be reviewed and updated at least annually. LTC facilities will have to comply with the requirements in § 483.73(d)(1) and (2).

With respect to § 483.73(d)(1), each LTC facility will have to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of that training. Thereafter, each LTC facility will have to provide the training at least annually.

Existing requirements for LTC facilities require facilities to “train all employees in emergency procedures when they begin to work in the facility” and “periodically review the procedures with existing staff” (See existing § 483.75(m)(2)). Therefore, we expect that LTC facilities already provide some type of emergency preparedness training program for new employees, as well as ongoing training for all staff. However, to ensure compliance with the requirements of this final rule, all LTC facilities will need to review their current training programs to ensure that they met all of the requirements in this final rule.

Each LTC facility will need to compare its current emergency preparedness training program's contents to its updated emergency preparedness plan, risk assessment, policies and procedures, and communication plan and then review, revise, and, if necessary, develop new sections for its training program to ensure that it complied with these requirements.

The burden associated with complying with this requirement will be the time and effort necessary for a LTC facility to compare its current emergency preparedness training program's contents to its updated emergency preparedness plan, risk assessment, policies and procedures, and communication plan and then review, revise, and, if necessary, develop new sections for its training program to ensure that it complies with the requirements of this final rule. We believe that these activities will require the involvement of an administrator and the director of nursing. We expect that the director of nursing will likely spend more time than the administrator working on the training program. We estimate that complying with this requirement will require 10 burden hours for each LTC facility at an estimated cost of $850. For all 15,699 LTC facilities to comply with this requirement, it will require an estimated 156,990 burden hours (10 burden hours for each LTC facility × 15,699 LTC facilities) at a cost of $13,344,150 ($850 estimated cost for each LTC facility × 15,699 LTC facilities).

Each LTC facility will be required to review and update its emergency preparedness training program at least annually. We believe that LTC facilities already review and update their training programs periodically. Thus, compliance with this requirement will constitute a usual and customary business practices for LTC facilities and will not be subject to the PRA in accordance with 5 CFR 1320.3(b)(2).

Section 483.73(d)(2) will require LTC facilities to participate in a full-scale exercise at least annually. LTC facilities are also required to participate in one additional testing exercise of their choice at least annually. LTC facilities will also have to analyze their responses to, and maintain documentation of all exercises and emergency events. If a LTC facility experienced an actual emergency which required activation of its emergency plan, the LTC facility will be exempt from the requirement for a community or individual, facility-based disaster exercise for 1 year following the onset of the actual event (§ 483.73(d)(2)(ii)).

To comply with these testing requirements, a LTC facility will need to develop a scenario for each exercise. A LTC facility will also need to develop the necessary documentation to record and analyze their response to all testing exercises and emergency events.

Existing requirements for LTC facilities already mandate that these facilities “periodically review the procedures with existing staff, and carry out unannounced staff drills” (§ 483.75(m)(2)). We expect that all LTC facilities are already developing and conducting drills or exercises for their disaster plans. It is also standard practice in the healthcare industry to document what happens during a drill, exercise, or emergency event and analyze the facility's response to those events. However, the LTC facility requirements do not specify how often the facility must conduct a drill or the type of drills. For purposes of determine the burden associated with the testing requirements in this final rule, we will assume that all LTC facilities will need to develop scenarios for their testing exercises and the documentation necessary to record the events during the testing exercises.

To comply with these requirements we expect it will mainly require the involvement of the director of nursing. We expect that the director of nursing will develop the required documentation, as well as the scenarios for the testing exercises. We expect that the administrator will provide some assistance and approve the scenarios. We estimate that these tasks will require 5 burden hours at a cost of $425. Based on this estimate, it will require 78,495 burden hours (5 burden hours for each LTC facility × 15,699 LTC facilities) for all 15,699 LTC facilities to comply with these requirements at a cost of $6,672,075 ($425 estimated cost for each LTC facility × 15,699 LTC facilities).

Comment: A commenter appreciated that OBRA '87 provided for a waiver of PRA requirements. However, the commenter requested that we publish the anticipated burden that these requirements would impose on LTC facilities for their information.

Response: We appreciate the commenter's request and have provided a discussion of the anticipated ICRs in this final rule.

K. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 483.475)

Section 483.475(a) will require intermediate care facilities for individuals with intellectual disabilities (ICF/IID) to develop and maintain an emergency preparedness plan that will have to be reviewed and updated at least annually. We proposed that the plan will include the elements set out at § 483.475(a)(1) through (4). We will discuss the burden for these activities individually beginning with the risk assessment.

Section 483.475(a)(1) will require each ICFs/IID to develop a documented, facility-based and community-based risk assessment utilizing an all-hazard approach, including missing clients. We expect an ICF/IID to identify the medical and non-medical emergency events it could experience in the facility and the community in which it is located and determine the likelihood of the facility experiencing an emergency due to the identified hazards. In performing the risk assessment, we expect that an ICF/IID will need to consider its physical location, the geographical area in which it is located, and its client population.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment. The current CoPs for ICFs/IID already require ICFs/IID to “develop and implement detailed written plans and procedures to meet all potential emergencies and disasters such as fires, severe weather, and missing clients” (42 CFR 483.470(h)(1)). During the process of developing these detailed written plans and procedures, we expect that all ICFs/IID have already performed some type of risk assessment. However, as discussed earlier in the preamble, the current requirement is primarily designed to ensure the health and safety of the ICF/IID clients during emergencies that are within the facility or in the facility's local area. We do not expect that this requirement will be sufficient to protect the health and safety of clients during more widespread local, state, or national emergencies. In addition, an ICF/IID current risk assessment may not address all of the elements required in § 483.475(a). Therefore, all ICFs/IID will have to conduct a thorough review of their current risk assessments, if they have them, and then perform the necessary tasks to ensure that their risk assessments comply with the requirements of this section.

We have not designated any specific process or format for ICFs/IID to use in conducting their risk assessments because we expect ICFs/IID will need maximum flexibility in determining the best way for their facilities to accomplish this task. However, we expect that in the process of developing a risk assessment, an ICF/IID will include representatives from, or obtain input from, all of the major departments in their facilities. Based on our experience with ICFs/IID, we expect that conducting the risk assessment will require the involvement of the ICF/IID administrator and a professional staff person, such as a registered nurse. We expect that both individuals will attend an initial meeting, review relevant sections of the current assessment, develop comments and recommendations for changes to the assessment, attend a follow-up meeting, perform a final review, and approve the risk assessment. We expect that the administrator will coordinate the meetings, perform an initial review of the current risk assessment, critique the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and assure that the necessary parties approve the new risk assessment. We also expect that the administrator will spend more time reviewing and working on the risk assessment. Thus, we estimate that complying with this requirement will require 8 burden hours to complete at a cost of $657. There are currently 6,237 ICFs/IID. Therefore, it will require an estimated 49,896 burden hours (8 burden hours for each ICF/IID × 6,237 ICFs/IID) for all ICFs/IID to comply with this requirement at a cost of $4,097,709 ($657 estimated cost for each ICF/IID × 6,237 ICFs/IID).

Under this final rule, ICFs/IID will be required to develop emergency preparedness plans that addressed the emergency events that could affect not only their facilities but also the communities in which they are located. An ICF/IID current disaster plan might not address all of the medical and non-medical emergency events identified by its risk assessment, include strategies for addressing those emergency events, or address its patient population. It may not specify the type of services the ICF/IID has the ability to provide in an emergency, or continuity of operations, including delegation of authority and succession plans. Thus, we expect that each ICFs/IID will have to review its current plans and compare them to its risk assessments. Each ICF/IID will then need to update, revise, and, in some cases, develop new sections to comply with our requirements.

The burden associated with this requirement will be the resources needed to review, revise, and develop new sections for an existing emergency plan. Based upon our experience with ICFs/IID, we expect that the same individuals who were involved in the risk assessment will be involved in developing the facility's new emergency preparedness plan. We also expect that developing the plan will be more labor intensive and will require more time to complete than the risk assessment. We estimate that it will require 9 burden hours at a cost of $750 for each ICF/IID to develop an emergency plan that complied with the requirements in this section. Based on this estimate, it will require 56,133 burden hours (9 burden hours for each ICF/IID × 6,237 ICFs/IID) to complete the plan at a cost of $4,677,750 ($750 estimated cost for each ICF/IID × 6,237 ICFs/IID).

The ICF/IID also will be required to review and update its emergency preparedness plan at least annually. We believe that ICFs/IID already review their emergency preparedness plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 483.475(b) will require each ICF/IID to develop and implement emergency preparedness policies and procedures, based on its emergency plan set forth in paragraph (a), the risk assessment at paragraph (a)(1), and the communication plan at paragraph (c). We will also require the ICF/IID to review and update these policies and procedures at least annually. At a minimum, the ICF/IID policies and procedures will be required to address the requirements listed at § 483.475(b)(1) through (8).

We expect all ICFs/IID to compare their current emergency preparedness policies and procedures to their emergency preparedness plans, risk assessments, and communication plans. They will then need to revise and, if necessary, develop new policies and procedures to ensure they comply with the requirements in this section.

We expect that all ICFs/II already have some emergency preparedness policies and procedures. As discussed earlier, the current CoPs for ICFs/IID require them to have “written . . . procedures to meet all potential emergencies and disasters” (§ 483.470(h)(1)). In addition, we expect that all ICFs/IID already have procedures that comply with some of the other requirements in this section. For example, as will be discussed later, current regulations require ICFs/IID to perform drills, evaluate the effectiveness of those drills, and take corrective action for any problems they detect (§ 483.470(i)). We expect that all ICFs/IID have developed procedures for safe evacuation from and return to the ICF/IID (§ 483.475(b)(4)) and a process to document and analyze drills and revise their emergency plan when they detect problems.

We expect that each ICF/IID will need to review its current disaster policies and procedures and assess whether they incorporate all of the elements we are proposing. Each ICF/IID also will need to revise, and, if needed, develop new policies and procedures.

The burden incurred by reviewing, revising, updating and, if necessary, developing new emergency policies and procedures will be the resources needed to ensure that the ICF/IID policies and procedures complied with the requirements of this section. We expect that these tasks will involve the ICF/IID administrator and a registered nurse. We estimate that for each ICF/IID to comply will require 9 burden hours at a cost of $750. Based on this estimate, for all 6,237 ICFs/IID to comply with this requirement will require 56,133 burden hours (9 burden hours for each ICF/IID × 6,237 ICFs/IID) at a cost of $4,677,750 ($750 estimated cost for each ICF/IID × 6,237 ICFs/IID).

We expect ICFs/IID to review and update their emergency preparedness policies and procedures at least annually. We believe that ICFs/IID already review their policies and procedures periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 483.475(c) will require each ICF/IID to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. The ICF/IID will also have to review and update the plan at least annually. The communication plan must include the information set out at § 483.475(c)(1) through (7).

We expect all ICFs/IID to compare their current emergency preparedness communications plans, if they have them, to the requirements in this section. The ICFs/IID also will need to perform any tasks necessary to ensure that they document their communication plans and that those plans comply with the requirements of this section.

We expect that all ICFs/IID have some type of emergency preparedness communication plan. The current CoPs require ICFs/IID to have written disaster plans and procedures for all potential emergencies (§ 483.470(h)(1)). We expect that an integral part of these plans and procedures will include communication. Furthermore, it is standard practice for healthcare organizations to maintain contact information for both staff and outside sources of assistance; have alternate means of communication in case there is an interruption in phone service to the facility (for example, cell phones); and have a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their clients. However, many ICFs/IID may not have a formal, written emergency preparedness communication plan, or their plan may not comply with all the elements we are requiring.

The burden associated with complying with this requirement will be the resources required to ensure that the ICF/IID emergency communication plan complied with the requirements. Based upon our experience with ICFs/IID, we anticipate that meeting the requirements in this section will primarily require the involvement of the ICF/IID administrator and a registered nurse. We estimate that for each ICF/IID to comply with the requirement will require 6 burden hours at a cost of $500. Therefore, for all 6,237 ICFs/IID to comply with this requirement will require an estimated 37,442 burden hours (6 burden hours for each ICF/IID × 6,237 ICFs/IID) at a cost of $3,118,500 ($500 estimated cost for each ICF/IID × 6,237 ICFs/IID).

The ICFs/IID will also have to review and update their emergency preparedness communication plans at least annually. We believe that ICFs/IID already review their plans, policies, and procedures periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 483.475(d) will require ICFs/IID to develop and maintain emergency preparedness training and testing programs that will have to be reviewed and updated at least annually. Each ICF/IID will also have to meet the requirements for evacuation drills and training at § 483.470(i).

To comply with the requirements at § 483.475(d)(1), an ICF/IID will have to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the ICF/IID will have to provide emergency preparedness training at least annually.

The ICFs/IID will need to compare their current emergency preparedness training programs' contents to their risk assessments and updated emergency preparedness plans, policies and procedures, and communication plans and then revise and, if necessary, develop new sections for their training programs to ensure they complied with the requirements. The current ICFs/IID CoPs require ICFs/IID to periodically review and provide training to their staff on the facility's emergency plan (§ 483.470(h)(2)). In addition, staff on all shifts must be trained to perform the tasks to which they are assigned for evacuations (§ 483.470(i)(1)(i)). We expect that all ICFs/IID have emergency preparedness training programs for their staff. However, under this final rule, each ICF/IID will need to review its current training program and compare its contents to its updated emergency preparedness plan, policies and procedures, and communications plan. Each ICF/IID also will need to revise and, if necessary, develop new sections for their training program to ensure it complied with the requirements.

The burden will be the time and effort necessary to comply with the requirements. We expect that a registered nurse will be primarily involved in reviewing the ICF/IID current training program and the ICF/IID updated emergency preparedness plan, policies, and procedures, and communication plan; determining what tasks will need to be performed to comply with the requirements of this section; accomplishing those tasks, and developing an updated training program. We expect the administrator will work with the registered nurse to update the training program. We estimate that it will require 7 burden hours for each ICF/IID to develop an emergency training program at a cost of $506. Therefore, it will require an estimated 43,659 burden hours (7 burden hours for each ICF/IID × 6,237 ICFs/IID) to comply with this requirement at a cost of $3,155,922 ($506 estimated cost for each ICF/IID × 6,237 ICFs/IID).

The ICFs/IID will have to review and update their emergency preparedness training program at least annually. We believe that ICFs/IID already review their emergency preparedness training programs periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 483.475(d)(2) will require ICFs/IID to participate in a full-scale exercise and one additional exercise of their choice at least annually. The ICFs/IID will also be required to analyze their responses to and maintain documentation of all testing exercises and emergency events, and revise their emergency plans, as needed. If an ICF/IID experienced an actual natural or man-made emergency that required activation of its emergency plan, the ICF/IID will be exempt from engaging in a full-scale exercise for 1 year following the onset of the actual event. To comply with this requirement, an ICF/IID will need to develop scenarios for each testing exercise. An ICF/IID also will have to develop the required documentation.

The current ICF/IID CoPs require them to hold evacuation drills at least quarterly for each shift and under varied conditions to evaluate the effectiveness of emergency and disaster plans and procedures (§ 483.470(i)(1)). In addition, ICFs/IID must “actually evacuate clients during at least one drill each year on each shift . . . file a report and evaluation on each evacuation drill . . . and investigate all problems with evacuation drills, including accidents, and take corrective action” (42 CFR 483.470(i)(2)). Thus, all 6,450 ICFs/IID already conduct quarterly drills. However, the current CoPs do not indicate the type of drills ICFs/IID must perform. In addition, although the CoPs require that a report and evaluation be filed, this requirement does not ensure that ICFs/IID have developed the type of paperwork we proposed requiring or that scenarios are used for each drill or tabletop exercise. For the purpose of determining a burden for these requirements, all ICFs/IID will have to develop scenarios and all ICFs/IID will have to develop the necessary documentation.

The burden associated with these requirements will be the resources the ICF/IID will need to comply with the requirements. We expect that complying with these requirements will likely require the involvement of a registered nurse. We expect that the registered nurse will develop the required documentation. We also expect that the registered nurse will develop the scenarios for the each testing exercise. We estimate that these tasks will require 4 burden hours at a cost of $256. Based on this estimate, for all 6,237 ICFs/IID to comply, it will require 24,948 burden hours (4 burden hours for each ICF/IID × 6,237 ICFs/IID) at a cost of $1,596,672 ($256 estimated cost for each ICF/IID × 6,237 ICFs/IID).

L. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 484.22)

Section 484.22(a) will require home health agencies (HHAs) to develop and maintain emergency preparedness plans. Each HHA also will be required to review and update the plan at least annually. Specifically, we proposed that the plan meet the requirements listed at § 484.22(a)(1) through (4). We will discuss the burden for these activities individually, beginning with the risk assessment.

Accreditation may substantially affect the burden a HHA will experience under this final rule. HHAs are accredited by three different accrediting organizations (AOs): The Joint Commission (TJC), The Community Health Accreditation Program (CHAP), and the Accreditation Commission for Health Care, Inc. (ACHC). After reviewing the accreditation standards for all three AOs, neither the standards for CHAP nor the ones for ACHC appeared to ensure substantial compliance with our requirements in this rule. Therefore, the HHAs accredited by CHAP and ACHC will be included with the non-accredited HHAs for the purposed of determining the burden for this final rule.

As of June 2016, there are currently 12,335 HHAs. There are 4,330 TJC-accredited HHAs. A review of TJC deeming standards indicates that the 4,330 TJC-accredited HHAs already perform certain tasks or activities that will partially or completely satisfy our requirements. Therefore, since TJC accreditation is a significant factor in determining the burden, we will analyze the burden for the 4,330 TJC-accredited HHAs separately from the 8,005 non TJC-accredited HHAs (12,335 HHAs-4,330 TJC-accredited HHAs), as appropriate. Note that we obtain data on the number of HHAs, both accredited and non-accredited, from the CMS CASPER data system, which is updated periodically by the individual states. Due to variations in the timeliness of the data submissions, all numbers are approximate, and the number of accredited and non-accredited HHAs may not equal the total number of HHAs.

Section 484.22(a)(1) will require that HHAs develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. To perform this risk assessment, an HHA will need to identify the medical and non-medical emergency events the HHA could experience and how the HHA's essential business functions and ability to provide services could be impacted by those emergency events based on the risks to the facility itself and the community in which it is located. We will expect HHAs to consider the extent of their service area, including the location of any branch offices. An HHA with an existing risk assessment will need to review, revise and update it to comply with our requirements.

For TJC accreditation standards, we used TJC's CAMHC Refreshed Core, January 2008 pages from the Comprehensive Accreditation Manual for Home Care 2008 (CAMHC). In the chapter entitled, “Environmental Safety and Equipment Management” (EC), TJC accreditation standards require HHAs to conduct proactive risk assessments to “evaluate the potential adverse impact of the external environment and the services provided on the security of patients, staff, and other people coming to the organization's facilities” (CAMHC, Standard EC.2.10, EP 3, p. EC-7). These proactive risk assessments should evaluate the risk to the entire organization, and the HHA should conduct one of these assessments whenever it identifies any new external risk factors or begins a new service (CAMHC, Standard EC.2.10, p. EC-7). Moreover, TJC-accredited HHAs are required to develop and maintain “a written emergency management plan describing the process for disaster readiness and emergency management . . . ” (CAMHC, Standard EC.4.10, EP 3, p. EC-9). In addition, TJC requires that these plans provide for “processes for managing . . . activities related to care, treatment, and services (for example, scheduling, modifying, or discontinuing services; controlling information about patients; referrals; transporting patients) . . . logistics relating to critical supplies . . . communicating with patient” during an emergency (CAMHC, Standard EC.4.10, EP 10, p. EC-9-10). We expect that any HHA that has conducted a proactive risk assessment and developed an emergency management plan that satisfies the previously described TJC accreditation requirements has already conducted a risk assessment that will satisfy our requirements. Any tasks needed to comply with our requirements will not result in any additional burden. Thus, for the 4,330 TJC-accredited HHAs, the risk assessment requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

It is standard practice for healthcare facilities to prepare for common internal and external medical and non-medical emergencies, based on their location, structure, and the services they provide. We believe that the 8,005 non TJC-accredited HHAs have conducted some type of risk assessment. However, those risk assessments are unlikely to satisfy all of our requirements. Therefore, we will analyze the burden for the 8,005 non TJC-accredited HHAs to comply.

We have not designated any specific process or format for HHAs to use in conducting their risk assessments because we believe that HHAs need the flexibility to determine the best way to accomplish this task. However, we expect that HHAs will include representatives from or input from all of their major departments. Based on our experience working with HHAs, we expect that conducting the risk assessment will require the involvement of an HHA administrator, the director of nursing, director of rehabilitation, and the office manager. We expect that these individuals will attend an initial meeting, review relevant sections of the current assessment, prepare and forward their comments to the administrator and the director of nursing, attend a follow-up meeting, perform a final review, and approve the new risk assessment. We expect that the director of nursing will coordinate the meetings, review the current risk assessment, provide suggestions, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approve it. We expect that the director of nursing will spend more time developing the facility's new risk assessment than the other individuals. We estimate that the risk assessment will require 11 burden hours for each non TJC-accredited HHA to complete at a cost of $959. There are currently about 8,005 non TJC-accredited HHAs. We estimate that for all non TJC-accredited HHAs to comply with this requirement will require 88,055 burden hours (11 burden hours for each non TJC-accredited HHA × 8,005 non TJC-accredited HHAs) at a cost of $7,676,795 ($959 estimated cost for each non TJC-accredited HHA × 8,005 non TJC-accredited HHAs).

After conducting a risk assessment, HHAs will have to develop an emergency preparedness plan that complied with § 484.22(a)(1) through (4). As discussed earlier, TJC already has accreditation standards similar to the requirements we proposed at § 484.22(a). Thus, we expect that TJC-accredited HHAs have an emergency preparedness plan that will satisfy most of our requirements. Although the current HHA CoPs require that there be a qualified person who “is authorized in writing to act in the absence of the administrator” (§ 484.14(c)), the TJC standards do not specifically address delegations of authority or succession plans. Furthermore, TJC standards do not address persons-at-risk. Therefore, we expect that the 1,815 TJC-accredited HHAs will incur some burden due to reviewing, revising, and in some cases, developing new sections for their emergency preparedness plans. However, we will analyze the burden for TJC-accredited HHAs separately from the 8,005 non TJC-accredited HHAs because we expect the burden for TJC-accredited HHAs to be substantially less.

We expect that the 8,005 non TJC-accredited HHAs already have some type of emergency preparedness plan, as well as delegations of authority and succession plans. However, we also expect that their plans do not comply with all of our requirements. Thus, all non TJC-accredited HHAs will need to review their current plans and compare them to their risk assessments. They also will need to update, revise, and, in some cases, develop new sections for their emergency plans.

Based on our experience with HHAs, we expect that the same individuals who were involved in the risk assessment will be involved in developing the emergency preparedness plan. We estimate that complying with this requirement will require 10 burden hours for each TJC-accredited HHA at a cost of $862. Therefore, for all 4,330 TJC-accredited HHAs to comply will require an estimated 43,300 burden hours (10 burden hours for each TJC-accredited HHA × 4,330 TJC-accredited HHAs) at a cost of $3,732,460 ($862 estimated cost for each HHA × 4,330 TJC-accredited HHAs).

We estimate that complying with this requirement will require 15 burden hours for each of the 8,005 non TJC-accredited HHAs at a cost of $1,293. Therefore, for all 8,005 non TJC-accredited HHAs to comply will require an estimated 120,075 burden hours (15 burden hours for each non TJC-accredited HHA × 8,005 non TJC-accredited HHAs) at a cost of $10,350,465 ($1,293 estimated cost for each non TJC-accredited HHA × 8,005 non TJC-accredited HHAs).

Based on these estimates, for all 12,335 HHAs to develop an emergency preparedness plan that complies with our requirements will require 163,375 burden hours at a cost of $14,082,925. We will also require HHAs to review and update their emergency preparedness plans at least annually. We believe that HHAs are already reviewing and updating their emergency preparedness plans periodically. Hence, we believe compliance with this requirement will constitute a usual and customary business practice for HHAs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 484.22(b) will require each HHA to develop and implement emergency preparedness policies and procedures based on the emergency plan, risk assessment, communication plan as set forth in § 484.22(a), (a)(1), and (c), respectively. The HHA will also have to review and update its policies and procedures at least annually. We will require that, at a minimum, these policies and procedures address the requirements listed at § 484.22(b)(1) through (6).

We expect that HHAs will review their emergency preparedness policies and procedures and compare them to their risk assessments, emergency preparedness plans, and emergency communication plans. HHAs will need to revise or, in some cases, develop new policies and procedures to ensure they complied with all of the requirements.

In the chapter entitled, “Leadership,” TJC accreditation standards require that each HHA's “leaders develop policies and procedures that guide and support patient care, treatment, and services” (CAMHC, Standard LD.3.90, EP 1, p. LD-13). In addition, TJC accreditation standards and EPs specifically require each HHA to develop and maintain an emergency management plan that provides processes for managing activities related to care, treatment, and services, including scheduling, modifying, or discontinuing services (CAMHC, Standard EC.4.10, EP 10, EC-9); identify backup communication systems in the event of failure due to an emergency event (CAMHC, Standard EC.4.10, EP 18, EC-10); and develop processes for critiquing tests of its emergency preparedness plan and modifying the plan in response to those critiques (CAMHC, Standard EC.4.20, EPs 15-17, p. EC-11).

We expect that the 4,330 TJC-accredited HHAs already have emergency preparedness policies and procedures that address some of the requirements at § 484.22(b). However, we do not believe that TJC accreditation requirements ensure that TJC-accredited HHAs' policies and procedures address all of our requirements for emergency policies and procedures. Thus, we will include the 4,330 TJC-accredited HHAs with the 8,005 non TJC-accredited HHAs in our analysis of the burden for § 484.22(b).

Under § 484.22(b)(1), the HHA's individual plans for patients during a natural or man-made disaster will be included as part of the comprehensive patient assessment, which will be conducted according to the provisions at § 484.55. We expect that HHAs already collect data during the comprehensive patient assessment that they will need to develop for each patient's emergency plan. At § 484.22(b)(2), we proposed requiring each HHA to have procedures to inform state and local emergency preparedness officials about HHA patients in need of evacuation from their residences at any time due to an emergency situation based on the patients' medical and psychiatric condition and home environment.

Existing HHA regulations already address § 484.22(b)(1) and (2). For example, regulations at § 484.18 make it clear that HHAs are expected to accept patients only on the basis of a reasonable expectation that they can provide for the patients' medical, nursing, and social needs in the patients' home. Moreover, the plan of care for each patient must cover any safety measures necessary to protect the patient from injury § 484.18(a). Thus, the activities necessary to be in compliance with § 484.22(b)(1) and (2) will constitute usual and customary business practices for HHA and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

We expect that all 12,520 HHAs have some emergency preparedness policies and procedures. However, we also expect that all HHAs will need to review their policies and procedures and revise and, if necessary, develop new policies and procedures that complied with our requirements set out at § 484.22(3) through (6). We expect that a professional staff person, most likely the director of nursing, will review the HHA's policies and procedures and make recommendations for changes or development of additional policies and procedures. The administrator or director of nursing will brief representatives of most of the HHA's major departments and assign staff to make necessary revisions and draft any new policies and procedures. We estimate that complying with this requirement will require 18 burden hours for each HHA at a cost of $1,584. Thus, for all 12,335 HHAs to comply with all of our requirements will require an estimated 222,030 burden hours (18 burden hours for each HHA × 12,335 HHAs) at a cost of $19,538,640 ($1,584 estimated cost for each HHA × 12,335 HHAs).

We are also proposing that HHAs review and update their emergency preparedness policies and procedures at least annually. The current CoPs require HHAs to establish and annually review the agency's policies governing scope of services offered, admission and discharge policies, medical supervision and plans of care, emergency clinical records and program evaluation. (42 CFR 484.16). Thus, we believe that complying with this requirement will constitute a usual and customary business practice for HHAs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

In § 484.22(c), each HHA will be required to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. We proposed that each HHA review and update its communication plan at least annually. We will require that the emergency communication plan include the information listed at § 484.22(c)(1) through (6).

It is standard practice for healthcare facilities to maintain contact information for both staff and outside sources of assistance; alternate means of communication in case there is an interruption in phone service to the facility; and a method of sharing information and medical documentation with other healthcare providers to ensure continuity of care for patients.

All TJC-accredited HHAs are required to identify backup communication systems for both internal and external communication in case of failure due to an emergency (CAMHC, Standard EC.4.10, EP 18, p. EC-10). They are required to have processes for notifying their staff when the HHA initiates its emergency plan (CAMHC, Standard EC.4.10, EP 7, p. EC-9); identifying and assigning staff to ensure that essential functions are covered during emergencies (CAMHC, Standard EC.4.10, EP 9, p. EC-9); and activities related to care, treatment, and services, such as controlling information about their patients (CAMHC, Standard EC.4.10, EP 10, p. EC-9). However, we do not believe these requirements ensure that all TJC-accredited HHAs are already in compliance with our requirements. Thus, we will include the 4,330 TJC-accredited HHAs with the 8,005 non TJC-accredited HHAs in assessing the burden for this requirement.

We expect that all 12,335 HHAs maintain some contact information, an alternate means of communication, and a method for sharing information with other healthcare facilities. However, this will not ensure that all HHAs will be in compliance with our requirements for communication plans. Thus, we will analyze the burden for this requirement for all 12,335 HHAs.

The burden associated with complying with this requirement will be the time and effort necessary for each HHA to review its existing communication plan, if any, and revise it; and, if necessary, to develop new sections for the emergency preparedness communication plan to ensure that it complied with our requirements. Based on our experience with HHAs, we expect that these activities will require the involvement of the HHA's administrator, director of nursing, director of rehabilitation, and office manager. We estimate that complying with this requirement will require 10 burden hours for each HHA at a cost of $826. Thus, for all 12,335 HHAs to comply with these requirements will require an estimated 123,350 burden hours (10 burden hours for each HHA × 123,350 HHAs) at a cost of $10,188,710 ($826 estimated cost for each HHA × 123,350 HHAs).

We proposed requiring HHAs to review and update their emergency preparedness communication plans at least annually. We believe that HHAs already review their emergency preparedness plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for HHAs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2). Section 484.22(d) will require each HHA to develop and maintain an emergency preparedness training and testing program. Each HHA will also have to review and update its training and testing program at least annually. Section 484.22(d)(1) states that each HHA will have to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the HHA will have to provide emergency preparedness training at least annually. Each HHA will also have to ensure that their staff could demonstrate knowledge of their emergency procedures.

Based on our experience with HHAs, we expect that all 12,335 HHAs have some type of emergency preparedness training program because this a key component of emergency preparedness and as stated earlier, it is standard practice for healthcare facilities to prepare for common internal and external medical and non-medical emergencies, based on their location, structure, and the services they provide. The 4,330 TJC-accredited HHAs are already required to provide both an initial orientation to their staff before they can provide care, treatment, or services (CAMHC, Standard HR.2.10, EP 2, p. HR-6) and “ongoing in-services, training or other staff activities [that] emphasize job-related aspects of safety . . .” (CAMHC, Standard HR.2.30, EP 4, p. HR-8). Since emergency preparedness is a critical aspect of job-related safety, we expect that TJC-accredited HHAs will ensure that their orientations and ongoing staff training will include the facility's emergency preparedness policies and procedures.

However, we expect that under § 484.22(d), all HHAs will need to compare their training and testing programs with their risk assessments, emergency preparedness plans, emergency policies and procedures, and emergency communication plans. We expect that most HHAs will need to revise and, in some cases, develop new sections for their training programs to ensure that they complied with our requirements. In addition, HHAs will need to provide an orientation and annual training in their facilities' emergency preparedness policies and procedures to individuals providing services under arrangement and volunteers, consistent with their expected roles. Hence, we will analyze the burden of these requirements for all 12,335 HHAs.

Based on our experience with HHAs, we expect that complying with this requirement will require the involvement of an administrator, the director of training, director of nursing, director of rehabilitation, and the office manager. We expect that the director of training will spend more time reviewing, revising or developing new sections for the training program than the other individuals. We estimate that it will require 16 burden hours for each HHA to develop an emergency preparedness training and testing program at a cost of $1,132. Thus, for all 12,335 HHAs to comply will require an estimated 197,360 burden hours (16 burden hours for each HHA × 12,335 HHAs) at a cost of $13,963,220 ($1,132 estimated cost for each HHA × 12,335 HHAs).

We also proposed that HHAs should review and update their emergency preparedness training programs at least annually. The current CoPs require HHAs to establish and annually review the agency's policies governing scope of services offered, admission and discharge policies, medical supervision and plans of care, emergency care clinical records, and program evaluation. We believe that HHAs already review their training and testing programs periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for HHAs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 484.22(d)(2) will require each HHA to conduct exercises to test its emergency plan. Each HHA will have to participate in a full-scale exercise and one additional exercise at least annually. If an HHA experiences an actual natural or man-made emergency that requires activation of the emergency plan, it will be exempt from engaging in a full-scale exercise for 1 year following the onset of the actual event. Each HHA will also be required to analyze its responses to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise its emergency plan as needed. For the purposes of determining the burden for these requirements, we expect that all HHAs will have to comply with all of the requirements. The burden associated with complying with this requirement will be the time and effort necessary to develop the scenarios for the testing exercises and the required documentation. All TJC-accredited HHAs are required to test their emergency management plan once a year; the test cannot be a tabletop exercise (CAMHC, Standard EC.4.20, EP 1 and Note 1, p. EC-11). The TJC also requires HHAs to critique the drills and modify their emergency management plans in response to those critiques (CAMHC, Standard EC.4.20, EPs 15-17, p. EC-11). Therefore, TJC-accredited HHAs already prepare scenarios for drills, develop documentation to record the events during drills, critique them, and modify their emergency preparedness plans in response. However, TJC standards do not describe what type of drill HHAs must conduct or require a tabletop exercise annually. Thus, TJC accreditation standards will not ensure that TJC-accredited HHAs will be in compliance with our requirements. Therefore, we will include the 4,330 TJC-accredited HHAs with the 8,005 non TJC-accredited HHAs in our analysis of the burden for these requirements.

Based on our experience with HHAs, we expect that the same individuals who are responsible for developing the HHA's training and testing program will develop the scenarios for the testing exercises and the accompanying documentation. We expect that the director of nursing will spend more time on these activities than will the other individuals. We estimate that it will require 7 burden hours for each HHA to comply with the requirements at an estimated cost of $586. Thus, for all 12,335 HHAs to comply with the requirements in this section will require an estimated 86,345 burden hours (7 burden hours for each HHA × 12,335 HHAs) at a cost of $7,228,310 ($586 estimated cost for each HHA × 12,335 HHAs).

M. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 485.68)

Section 485.68(a) will require all Comprehensive Outpatient Rehabilitation Facilities (CORFs) to develop and maintain an emergency preparedness plan that must be reviewed and updated at least annually. We proposed that the plan meet the requirements listed at § 485.68(a)(1) through (5).

Section 485.68(a)(1) will require a CORF to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. The CORFs will need to identify the medical and non-medical emergency events they could experience. The current CoPs for CORFs already require CORFs to have “written policies and procedures that specifically define the handling of patients, personnel, records, and the public during disasters” (§ 485.64). We expect that all CORFs have performed some type of risk assessment during the process of developing their disaster policies and procedures. However, their risk assessments may not meet our requirements. Therefore, we expect that all CORFs will need to review their existing risk assessments and perform the tasks necessary to ensure that those assessments meet our requirements.

We have not designated any specific process or format for CORFs to use in conducting their risk assessments because we believe they need the flexibility to determine how best to accomplish this task. However, we expect that CORFs will obtain input from all of their major departments. Based on our experience with CORFs, we expect that conducting the risk assessment will require the involvement of the CORF's administrator and a therapist. The type of therapists at each CORF varies, depending upon the services offered by the facility. For the purposes of determining the burden, we will assume that the therapist is a physical therapist. We expect that both the administrator and the therapist will attend an initial meeting, review relevant sections of the current assessment, develop comments and recommendations for changes, attend a follow-up meeting, perform a final review, and approve the new risk assessment. We expect that the administrator will coordinate the meetings, review and critique the risk assessment, coordinate comments, develop the new risk assessment, and ensure that it was approved.

We estimate that complying with this requirement will require 8 burden hours at a cost of $722. There are currently 205 CORFs. Therefore, it will require an estimated 1,640 burden hours (8 burden hours for each CORF × 205 CORFs) for all CORFs to comply at a cost of $148,010 ($722 estimated cost for each CORF × 205 CORFs).

After conducting the risk assessment, each CORF will need to review, revise, and, if necessary, develop new sections for its emergency plan so that it complied with our requirements. The current CoPs for CORFs require them to have a written disaster plan (§ 485.64) that must be developed and maintained with the assistance of appropriate experts and address, among other things, procedures concerning the transfer of casualties and records, notification of outside emergency personnel, and evacuation routes (§ 485.64(a)). Thus, we expect that all CORFs have some type of emergency preparedness plan. However, we also expect that all CORFs will need to review, revise, and develop new sections for their plans to ensure that their plans complied with all of our requirements.

Based on our experience with CORFs, we expect that the administrator and physical therapist who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we expect that it will require more time to complete the emergency plan than to complete the risk assessment. We estimate that complying with this requirement will require 11burden hours at a cost of $1,013 for each CORF. Therefore, it will require an estimated 2,255 burden hours (11 burden hours for each CORF × 205 CORFs) for all CORFs to complete an emergency preparedness plan at a cost of $207,665 ($1,013 estimated cost for each CORF × 205 CORFs).

The CORF also will be required to review and update its emergency preparedness plan at least annually. We believe that CORFs already review their plans periodically. Therefore, compliance with the requirement for an annual review of the emergency preparedness plan will constitute a usual and customary business practice for CORFs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.68(b) will require CORFs to develop and implement emergency preparedness policies and procedures based on their emergency plans, risk assessments, and communication plans as set forth in § 485.68(a), (a)(1), and (c), respectively. We will also require CORFs to review and update these policies and procedures at least annually. We will require that a CORF's policies and procedures address, at a minimum, the requirements listed at § 485.68(b)(1) through (4).

We expect that all CORFs have some emergency preparedness policies and procedures. As discussed earlier, the current CoPs for CORFs already require CORFs to have “written policies and procedures that specifically define the handling of patients, personnel, records, and the public during disasters” (42 CFR 485.64). However, all CORFs will need to review their policies and procedures and compare them to their risk assessments, emergency preparedness plans, and communication plans. Most CORFs will need to revise their existing policies and procedures or develop new policies and procedures to ensure they complied with all of our requirements.

We expect that both the administrator and the therapist will attend an initial meeting, review relevant policies and procedures, make recommendations for changes, attend a follow-up meeting, perform a final review, and approve the policies and procedures. We expect that the administrator will coordinate the meetings, coordinate the comments, and ensure that they are approved.

We estimate that it will take 9 burden hours for each CORF to comply with this requirement at a cost of $819. Therefore, it will take all 205 CORFs 1,845 burden hours (9 burden hours for each CORF × 205 CORFs = 1,845 burden hours) to comply with this requirement at a cost of $167,895 ($819 estimated cost for each CORF × 205 CORFs).

Section 485.68(b) also proposes that CORFs review and update their emergency preparedness policies and procedures at least annually. We believe that CORFs already review their policies and procedures periodically. Therefore, we believe that complying with this requirement will constitute a usual and customary business practice for CORFs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.68(c) will require CORFs to develop and maintain emergency preparedness communication plans that complied with both federal and state law and that will be reviewed and updated at least annually. We proposed that a CORF's communication plan include the information listed in § 485.68(c)(1) through (5). Current CoPs require CORFs to have a written disaster plan that must include, among other things, “procedures for notifying community emergency personnel” (§ 486.64(a)(2)). In addition, it is standard practice in the healthcare industry to maintain contact information for staff and outside sources of assistance; alternate means of communication in case there is an interruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. However, many CORFs may not have formal, written emergency preparedness communication plans. Therefore, we expect that all CORFs will need to review, update, and in some cases, develop new sections for their plans to ensure they complied with all of our requirements.

Based on our experience with CORFs, we anticipate that satisfying the requirements in this section will primarily require the involvement of the CORF's administrator with the assistance of a physical therapist to review, revise, and, if needed, develop new sections for the CORF's emergency preparedness communication plan. We estimate that it will take 8 burden hours for each CORF to comply with this requirement at a cost of $722. Therefore, it will take 1,640 burden hours (8 burden hours for each CORF × 205 CORFs) for all CORFs to comply at a cost of $148,010 ($722 estimated cost for each CORF × 205 CORFs).

We proposed that each CORF will also have to review and update its emergency preparedness communication plan at least annually. We believe that compliance with this requirement will constitute a usual and customary business practice for CORFs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.68(d) will require CORFs to develop and maintain an emergency preparedness training and testing program that must be reviewed and updated at least annually. We proposed that each CORF will have to satisfy the requirements listed at § 485.68(d)(1) and (2).

Section 485.68(d)(1) will require that each CORF provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, each CORF will have to provide emergency preparedness training at least annually. Each CORF will also have to ensure that its staff could demonstrate knowledge of its emergency procedures. All new personnel will have to be oriented and assigned specific responsibilities regarding the CORF's emergency plan within two weeks of their first workday. In addition, the training program will have to include instruction in the location and use of alarm systems and signals and firefighting equipment.

The current CORF CoPs at § 485.64 require CORFs to ensure that all personnel are knowledgeable, trained, and assigned specific responsibilities regarding the facility's disaster procedures. Section 485.64(b)(1) specifies that CORFs must also provide ongoing training and drills for all personnel associated with the facility in all aspects of disaster preparedness. In addition, § 485.64(b)(2) specifies that all new personnel must be oriented and assigned specific responsibilities regarding the facility's disaster plan within 2 weeks of their first workday.

In evaluating the requirement for § 485.68(d)(1), we expect that all CORFs have an emergency preparedness training program for new employees, as well as ongoing training for all staff. However, under this final rule, all CORFs will need to compare their current training programs to their risk assessments, emergency preparedness plans, policies and procedures, and communication plans. CORFs will then need to revise, and in some cases, develop new material for their training programs.

We expect that these tasks will require the involvement of an administrator and a physical therapist. We expect that the administrator will review the CORF's current training program to identify necessary changes and additions to the program. We expect that the physical therapist will work with the administrator to develop the revised and updated training program. We estimate it will require 8 burden hours for each CORF to develop an emergency training program at a cost of $722. Therefore, for all CORFs to comply will require an estimated 1,640 burden hours (8 burden hours for each CORF × 205 CORFs) at a cost of $148,010 ($722 estimated cost for each CORF × 205 CORFs).

We also proposed that each CORF review and update its emergency preparedness training program at least annually. We believe that CORFs already review their training programs periodically. Thus, we believe complying with the requirement for an annual review of the emergency preparedness training program will constitute a usual and customary business practice for CORFs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.68(d)(2) will require CORFs to participate in a full-scale exercise and a paper-based, tabletop exercise at least annually. If a full-scale exercise was not available, the CORF will have to conduct a full-scale exercise at least annually. If a CORF experienced an actual natural or man-made emergency that required activation of its emergency plan, it will be exempt from engaging in a full-scale exercise for 1 year following the onset of the actual event. CORFs will also be required to analyze their responses to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise their emergency plans, as needed. To comply with this requirement, a CORF will need to develop scenarios for these drills and exercises. The current CoPs at § 485.64(b)(1) require CORFs to provide ongoing training and drills for all personnel associated with the facility in all aspects of disaster preparedness.” However, the current CoPs do not specify the type of drill, how often the CORF must conduct drills, or that a CORF must use scenarios for their drills and tabletop exercises.

Based on our experience with CORFs, we expect that the same individuals who develop the emergency preparedness training program will develop the scenarios for the drills and exercises, as well as the accompanying documentation. We expect that the administrator will spend more time on these tasks than the physical therapist. We estimate that for each CORF to comply with the requirements will require 6 burden hours at a cost of $546. Therefore, for all 205 CORFs to comply will require an estimated 1,230 burden hours (6 burden hours for each CORF × 205 CORFs) at a cost of $111,930 ($528 estimated cost for each CORF × 221 CORFs).

Based on the previous analysis, for all 205 CORFs to comply with the ICRs contained in this final rule will require 10,250 total burden hours at a total cost of $931,520.

N. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 485.625)

Section 485.625(a) will require critical access hospitals (CAHs) to develop and maintain a comprehensive emergency preparedness program that utilizes an all-hazards approach and will have to be reviewed and updated at least annually. Each CAH's emergency plan will have to include the elements listed at § 485.625(a)(1) through (4).

Section 485.625(a)(1) will require each CAH to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. CAHs will need to review their existing risk assessments and perform any tasks necessary to ensure that it complied with our requirements.

As of June 2016, there are approximately 1,337 CAHs. CAHs with distinct part units were included in the hospital burden analysis. Approximately 445 CAHs are accredited either by TJC (338), DNV GL (76), or by the AOA/HFAP (31); the remainder are non-accredited CAHs.

Many of the TJC and AOA/HFAP accreditation standards for CAHs are similar to the requirements in this final rule. For purposes of determining the burden, we have analyzed the burden for the 338 TJC-accredited and 31 AOA/HFAP-accredited CAHs separately from the non-accredited CAHs. DNV GL's accreditation standards do not meet the requirements for emergency preparedness of this final rule and as a result, we have included the DNV GL-accredited CAHs with the non-accredited CAHs in our burden analysis. Note that we obtained data on the number of CAHs, both accredited and non-accredited, from the CMS CASPER database, which is updated periodically by the individual states. Due to variations in the timeliness of the data submissions, all numbers are approximate, and the number of accredited and non-accredited CAHs may not equal the total number of CAHs.

For purposes of determining the burden for TJC-accredited CAHs, we used TJC's Comprehensive Accreditation Manual for Critical Access Hospitals: The Official Handbook 2008 (CAMCAH). In the chapter entitled, “Management of the Environment of Care” (EC), Standard EC.4.11 requires CAHs to plan for managing the consequences of emergency events (CAMCAH, Standard EC.4.11, CAMCAH Refreshed Care, January 2008, pp. EC-10-EC-11). CAHs are required to perform a hazard vulnerability analysis (HVA), which requires each CAH to, among other things, “identify events that could affect demand for its services or its ability to provide those services, the likelihood of those events occurring, and the consequences of those events” (Standard EC.4.11, EP 2, p. EC-10a). The HVA “should identify potential hazards, threats, and adverse events, and assess their impact on the care, treatment, and services [the CAH] must sustain during an emergency,” and the HVA “is designed to assist [CAHs] in gaining a realistic understanding of their vulnerabilities, and to help focus their resources and planning efforts” (CAMCAH, Emergency Management, Introduction, p. EC-10). Thus, we expect that TJC-accredited CAHs already conduct a risk assessment that will comply with the requirements we proposed. Thus, for the 338 TJC-accredited CAHs, the risk assessment requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

For purposes of determining the burden for AOA/HFAP-accredited CAHs, we used the AOA/HFAP's Healthcare Facilities Accreditation Program: Accreditation Requirements for Critical Access CAHs 2007 (ARCAH). In Chapter 11 entitled, “Physical Environment,” CAHs are required to have disaster plans, external disaster plans that include triaging victims, and weapons of mass destruction response plans (ARCAH, Standards 11.07.01, 11.07.02, and 11.07.05-6, pp. 11-38 through 11-41, respectively). In addition, AOA/HFAP-accredited CAHs must “coordinate with federal, state, and local emergency preparedness and health authorities to identify likely risks for their area . . . and to develop appropriate responses” (ARCAH, Standard 11.02.02, p. 11-5). Thus, we believe that to develop their plans, AOA/HFAP-accredited CAHs already perform some type of risk assessment. However, the AOA/HFAP standards do not require a documented facility-based and community-based risk assessment, as we proposed. Therefore, we will include the 31 AOA/HFAP-accredited CAHs with non-accredited CAHs in determining the burden for our risk assessment requirement.

The CAH CoPs currently require CAHs to assure the safety of their patients in nonmedical emergencies (§ 485.623) and to take appropriate measures that are consistent with the particular conditions in the area in which the CAH is located (§ 485.623(c)(4)). To satisfy this requirement in the CoPs, we expect that CAHs have already conducted some type of risk assessment. However, that requirement does not ensure that CAHs have conducted a documented, facility-based, and community-based risk assessment that will satisfy our requirements.

We believe that under this final rule, the 999 non TJC-accredited CAHs (1,337 CAHs−338 TJC-accredited CAHs) will need to review, revise, and, in some cases, develop new sections for their current risk assessments to ensure compliance with all of our requirements.

We have not designated any specific process or format for CAHs to use in conducting their risk assessments because we believe that CAHs need the flexibility to determine the best way to accomplish this task. However, we expect that CAHs will include representatives from or obtain input from all of their major departments in the process of developing their risk assessments.

Based on our experience with CAHs, we expect that these activities will require the involvement of a CAH's administrator, medical director, director of nursing, facilities director, and food services director. We expect that these individuals will attend an initial meeting, review relevant sections of the current risk assessment, provide comments, attend a follow-up meeting, perform a final review, and approve the new or updated risk assessment. We expect the administrator will coordinate the meetings, perform an initial review of the current risk assessment, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approved it.

We estimate that the risk assessment requirement for non TJC-accredited CAHs will require 15 burden hours to complete at a cost of $1,495. We estimate that for the 999 non TJC-accredited CAHs to comply with the risk assessment requirement will require 14,985 burden hours (15 burden hours for each CAH × 999 non TJC-accredited CAHs) at a cost of $1,493,505 ($1,495 estimated cost for each non TJC-accredited CAH × 999 non TJC-accredited CAHs).

After conducting the risk assessment, CAHs will have to develop and maintain emergency preparedness plans that comply with § 485.625(a)(1) through (4). We will expect all CAHs to compare their emergency plans to their risk assessments and then revise and, if necessary, develop new sections for their emergency plans to ensure that they complied with our requirements.

TJC-accredited CAHs must develop and maintain an Emergency Operations Plan (EOP) (CAMCAH Standard EC.4.12, p. EC-10a). The EOP must cover the management of six critical areas during emergencies: Communications, resources and assets, safety and security, staff roles and responsibilities, utilities, and patient clinical and support activities (CAMCAH, Standards EC.4.12 through 4.18, pp. EC-10a-EC-10g). In addition, as discussed earlier, TJC-accredited CAHs also are required to conduct an HVA (CAMCAH, Standard EC.4.11, EP 2, p. EC-10a). Therefore, we expect that the 338 TJC-accredited CAHs already have emergency preparedness plans that will satisfy our requirements. If a CAH needed to complete additional tasks to comply with the requirement, the burden will be negligible. Thus, for the 338 TJC-accredited CAHs, this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

The AOA/HFAP-accredited CAHs must work with federal, state, and local emergency preparedness authorities to identify the likely risks for their location and geographical area and develop appropriate responses to assure the safety of their patients (ARCAH, Standard 11.02.02, p. 11-5). Among the elements that AOA/HFAP-accredited CAHs must specifically consider are the special needs of their patient population, availability of medical and non-medical supplies, both internal and external communications, and the transfer of patients to home or other healthcare settings (ARCAH, Standard 11.02.02, p. 11-5). In addition, there are requirements for disaster and disaster response plans (ARCAH, Standards 11.07.01, 11.07.02, and 11.07.06, pp. 11-38 through 11-40). There also are specific requirements for plans for responses to weapons of mass destruction, including chemical, nuclear, and biological weapons; communicable diseases, and chemical exposures (ARCAH, Standards 11.07.02 and 11.07.05-11.07.06, pp. 11-39 through 11-41). However, the AOA/HFAP accreditation requirements require only that CAHs assess their most likely risks (ARCAH, Standard 11-02.02, p. 11-5), and we are proposing that CAHs be required to conduct a risk assessment utilizing an all-hazards approach. Thus, we expect that AOA/HFAP-accredited CAHs will have to compare their risk assessments they conducted in accordance with § 485.625(a)(1) to their current plans and then revise, and in some cases develop new sections for, their plans. Therefore, we will assess the burden for these 31 AOA/HFAP-accredited CAHs with the non-accredited CAHs.

The CAH CoPs require all CAHs to ensure the safety of their patients during non-medical emergencies (§ 485.623). They are also required to provide, among other things, for evacuation of patients, cooperation with disaster authorities, emergency power and lighting in their emergency rooms and for flashlights and battery lamps in other areas, an emergency water and fuel supply, and any other appropriate measures that are consistent with their particular location (§ 485.623). Thus, we believe that all CAHs have developed some type of emergency preparedness plan. However, we also expect that the 999 non-accredited CAHs will have to review their current plans and compare them to their risk assessments and revise and, in some cases, develop new sections for their current plans to ensure that their plans will satisfy our requirements.

Based on our experience with CAHs, we expect that the same individuals who were involved in conducting the risk assessment will be involved in developing the emergency preparedness plan. We expect that these individuals will attend an initial meeting, review relevant sections of the current emergency preparedness plan(s), prepare and send their comments to the administrator, attend a follow-up meeting, perform a final review, and approve the new plan. We expect that the administrator will coordinate the meetings, perform an initial review, coordinate comments, revise the plan, and ensure that the necessary parties approve the new plan. We estimate that complying with this requirement will require 26 burden hours at a cost of $2,561. Therefore, we estimate that for all 999 non TJC-accredited CAHs to comply with this requirement will require 25,974 burden hours (26 burden hours for each non TJC-accredited CAH × 999 non TJC-accredited CAHs) at a cost of $2,558,439 ($2,561 estimated cost for each non TJC-accredited CAH × 999 non TJC-accredited CAHs).

Under this final rule, CAHs also will be required to review and update their emergency preparedness plans at least annually. The CAH CoPs already require CAHs to perform a periodic evaluation of their total program at least once a year (§ 485.641(a)(1)). Hence, all CAHs should already have an individual or team that is responsible that is for the periodic review of their total program. Therefore, we believe that this requirement will constitute a usual and customary business practice for CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA 5 CFR 1320.3(b)(2).

Under § 485.625(b), we will require CAHs to develop and maintain emergency preparedness policies and procedures based on their emergency plans, risk assessments, and communication plans as set forth in § 485.625(a), (a)(1), and (c), respectively. We will also require CAHs to review and update these policies and procedures at least annually. These policies and procedures will have to address, at a minimum, the requirements listed at § 485.625(b)(1) through (8).

We expect that all CAHs will review their policies and procedures and compare them to their risk assessments, emergency preparedness plans, and emergency communication plans. The CAHs will need to revise, and, in some cases, develop new policies and procedures to incorporate all of the provisions previously noted and address all of our requirements.

The CAMCAH chapter entitled, “Leadership” (LD), requires TJC-accredited CAH leaders to “develop policies and procedures that guide and support patient care, treatment, and services” (CAMCAH, Standard LC.3.90, EP 1, CAMCAH Refreshed Core, January 2008, p. LD-11). Thus, we expect that TJC-accredited CAHs already have some policies and procedures for the activities and processes required for accreditation, including their EOP. As discussed later, many of the required elements we proposed have a corresponding requirement in the CAH TJC accreditation standards.

We proposed at § 485.625(b)(1) that CAHs have policies and procedures that address the provision of subsistence needs for staff and patients, whether they evacuate or shelter in place. TJC-accredited CAHs must make plans for obtaining and replenishing medical and non-medical supplies, including food, water, and fuel for generators and transportation vehicles (CAMCAH, Standard EC.4.14, EPs 1-4, p. EC-10d). In addition, they must identify alternative means of providing electricity, water, fuel, and other essential utility needs in cases where their usual supply is disrupted or compromised (CAMCAH, Standard EC.4.17, EPs 1-5, p. EC-10f). We expect that TJC-accredited CAHs that comply with these requirements will be in compliance with our requirement concerning subsistence needs at § 485.625(b)(1).

We are proposing at § 485.625(b)(2) that CAHs have policies and procedures for a system to track the location of on-duty staff and sheltered patients in the CAH's care during an emergency. TJC-accredited CAHs must plan for communicating with their staff, as well as patients and their families, at the beginning of and during an emergency (CAMCAH, Standard EC.4.13, EPs 1, 2, and 5, p. EC-10c). We expect that TJC-accredited CAHs that comply with these requirements will be in compliance with our requirement.

Section 485.625(b)(3) will require CAHs to have a plan for the safe evacuation from the CAH. TJC-accredited CAHs are required to make plans to evacuate patients as part of managing their clinical activities (CAMCAH, Standard EC.4.18, EP 1, p. EC-10g). They also must plan for the evacuation and transport of patients, their information, medications, supplies, and equipment to alternative care sites (ACSs) when the CAH cannot provide care, treatment, and services in its facility (CAMCAH, Standard EC.4.14, EPs 9-11, p. EC-10d). We expect that TJC-accredited CAHs that comply with these requirements will be in compliance with our requirement.

We proposed at § 485.625(b)(4) that CAHs have policies and procedures for a means to shelter in place for patients, staff, and volunteers who remain in the facility. The rationale for CAMCAH Standard EC.4.18 states, “[a] catastrophic emergency may result in the decision to keep all patients on the premises in the interest of safety” (CAMCAH, Standard EC.4.18, p. EC-10f). Therefore, we expect that TJC-accredited CAHs will be substantially in compliance with our requirement.

Section 485.625(b)(5) will require CAHs to have policies and procedures that address a system of medical documentation that preserves patient information, protects the confidentiality of patient information, and ensures that records are secure and readily available. The CAMCAH chapter entitled “Management of Information” (IM), requires TJC-accredited CAHs to have storage and retrieval systems for their clinical/service and CAH-specific information (CAMCAH, Standard IM.3.10, EP 5, CAMCAH Refreshed Core, January 2008, p. IM-11), as well as to ensure the continuity of their critical information for patient care, treatment, and services (CAMCAH, Standard IM.2.30, CAMCAH Refreshed Core, January 2008, p. IM-9). They also must ensure the privacy and confidentiality of patient information (CAMCAH, Standard IM.2.10, CAMCAH Refreshed Core, January 2008, p. IM-7). In addition, TJC-accredited CAHs must have plans for transporting patients and their clinical information, including transferring information to ACSs (CAMCAH Standard EC.4.14, EP 10 and 11, p. EC-10d and Standard EC.4.18, EP 6, pp. EC-10g, respectively). Therefore, we expect that TJC-accredited CAHs will be substantially in compliance with § 485.625(b)(5).

Section 485.625(b)(6) will require CAHs to have policies and procedures that addressed the use of volunteers in an emergency or other emergency staffing strategies. TJC-accredited CAHs must define staff roles and responsibilities in their EOP and ensure that they train their staff for their assigned roles (CAMCAH, Standard EC.4.16, EPs 1 and 2, p. EC-10e). Also, the rationale for Standard EC.4.15 indicates that the CAH “determines the type of access and movement to be allowed by . . . emergency volunteers . . . when emergency measures are initiated” (CAMCAH, Standard EC.4.15, Rationale, p. EC-10d). In addition, in the chapter entitled “Medical Staff” (MS), CAHs “may grant disaster privileges to volunteers that are eligible to be licensed independent practitioners” (CAMCAH, Standard MS.4.110, CAMCAH Refreshed Care, January 2008, p. MS-20). Finally, in the chapter entitled “Management of Human Resources” (HR), CAHs “may assign disaster responsibilities to volunteer practitioners” (CAMCAH, Standard HR.1.25, CAMCAH Refreshed Core, January 2008, p. HR-6). Although the TJC accreditation requirements address some of our requirements, we do not believe TJC-accredited CAHs will be in compliance with all requirements in § 485.625(b)(6).

Based upon the previous discussion, we expect that the activities required for compliance by TJC-accredited CAHs with § 485.625(b)(1) through (5) constitutes usual and customary business practices for PRAs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

However, we do not believe TJC-accredited CAHs will be substantially in compliance with § 485.625(b)(6) through (8). We will discuss the burden for TJC-accredited CAHs to comply with these requirements later in this section.

The AOA/HFAP accreditation standards also contain requirements for policies and procedures related to safety and disaster preparedness. The AOA/HFAP-accredited CAHs are required to maintain plans and performance standards for disaster preparedness (ARCAH, Standard 11.00.02 Required Plans and Performance Standards, p. 11-2). They also must have “written procedures for possible situations to be followed by each department and service within the CAH and for each building used for patient treatment or housing” (ARCAH, Standard 11.07.01 Disaster Plans, Explanation, p. 11-38). AOA/HFAP-accredited CAHs also are required to have a safety team or committee that is responsible for all issues related to safety within the CAH (ARCAH, Standard 11.02.03, p. 11-7). The individuals or team will be responsible for all policies and procedures related to safety in the CAH (ARCAH, Standard 11.02.03, Explanation, p. 11-7). We expect that these performance standards and procedures are similar to some of our requirements for policies and procedures.

In regard to § 485.625(b)(1), AOA/HFAP-accredited CAHs are required to consider “pharmaceuticals, food, other supplies and equipment that may be needed during emergency/disaster situations” and “provisions if gas, water, electricity supply is shut off to the community” when they are developing their emergency plans (ARCAH, Standard 11.02.02 Building Safety, Elements 5 and 11, pp. 11-5 and 11-6, respectively). In addition, CAHs are required “to provide emergency gas and water as needed to provide care to inpatients and other persons who may come to the CAH in need of care” (ARCAH, Standard 11.03.22 Emergency Gas and Water, p. 11-22 through 11-23). However, these standards do not specifically address all of the requirements in this section.

In regard to § 485.625(b)(2), AOA/HFAP-accredited CAHs are required to consider how they will communicate with their staff within the CAH when developing their emergency plans (ARCAH, Standard 11.02.02 Building Safety, Element 7, p. 11-6). They also are required to have a “call tree” in their external disaster plan that must be updated at least annually (ARCAH, Standard 11.07.04 Staff Call Tree, p. 11-40). However, these requirements do not sufficiently cover the requirements to track the location of staff and patients during and after an emergency.

In regard to § 485.625(b)(3), which requires policies and procedures regarding the safe evacuation from the facility, AOA/HFAP-accredited CAHs are required to consider the “transfer or discharge of patients to home, other healthcare settings, or other CAHs” and the “transfer of patients with CAH equipment to another CAH or healthcare setting” (ARCAH, Standard 11.02.02 Building Safety, Elements 12 and 13, p. 11-6). AOA/HFAP-accredited CAHs also are required to consider in their emergency plans how to maintain communication with external entities should their telephones and computers either cease to operate or become overloaded (ARCAH, Standard 11.02.02, Element 6, p. 11-6). AOA/HFAP-accredited CAHs must also “develop and implement a comprehensive plan to ensure that the safety and well-being of patients are assured during emergency situations” (ARCAH, Standard 11.02.02 Building Safety, pp. 11-4 through 11-7). However, we do not believe these requirements are detailed enough to ensure that AOA/HFAP-accredited CAHs are compliant with our requirements.

In regard to § 485.625(b)(4), AOA/HFAP-accredited CAHs are required to consider the special needs of their patient population and the security of those patients and others that come to them for care when they develop their emergency plans (ARCAH, Standard 11.02.02 Building Safety, Elements 2 and 3, p. 11-5). In addition, as described earlier, they also must consider the food, pharmaceuticals, and other supplies and equipment they may need during an emergency in developing their emergency plan (ARCAH, Standard 11.02.02, Element 5, p. 11-5). However, these requirements do not specifically mention volunteers and CAHs are required only to consider these elements in developing their plans.

Therefore, we believe that AOA/HFAP-accredited CAHs have likely already incorporated many of the elements necessary to satisfy the requirements in § 485.625(b); however, they will need to thoroughly review their current policies and procedures and perform whatever tasks are necessary to ensure that they complied with all of our requirements for emergency policies and procedures. Because we expect that AOA/HFAP-accredited CAHs already comply with many of our requirements, we will include the AOA/HFAP-accredited CAHs with the TJC-accredited CAHs in determining the burden.

The burden for the 31 AOA/HFAP-accredited CAHs and the 338 TJC-accredited CAHs to comply with all of the requirements in § 485.625(b) will be the resources required to develop written policies and procedures that comply with all of our requirements for emergency policies and procedures. Based on our experience working with CAHs, we expect that accomplishing these activities will require the involvement of an administrator, the medical director, director of nursing, facilities director, and food services director. We expect that the administrator will review the policies and procedures and make recommendations for necessary changes or additional policies or procedures. The CAH administrator will brief other staff and assign staff to make necessary revisions or draft new policies and procedures and disseminate them to the appropriate parties. We estimate that complying with this requirement will require 10 burden hours for each TJC and AOA/HFAP-accredited CAH at a cost of $983. For all 369 TJC and AOA/HFAP-accredited CAHs to comply with these requirements will require an estimated 3,690 burden hours (10 burden hours for each TJC or AOA/HFAP-accredited CAH × 369 TJC and AOA/HFAP-accredited CAHs) at a cost of $362,727 ($983 estimated cost for each TJC or AOA/HFAP-accredited CAH × 369 TJC and AOA/HFAP-accredited CAHs).

We expect that the 892 non-accredited CAHs already have developed some emergency preparedness policies and procedures. The current CAH CoPs require CAHs to develop, maintain, and review policies to ensure quality care and a safe environment for their patients (§§ 485.627(a), 485.635(a), and 485.641(a)(1)(iii)). In addition, certain activities associated with our requirements are addressed in the current CAH CoPs. For example, all CAHs are required to have agreements or arrangements with one or more providers or suppliers, as appropriate, to provide services to their patients (§ 485.635(c)).

The burden associated with the development of emergency policies and procedures will be the resources needed to review, revise, and if needed, develop emergency preparedness policies and procedures that include our requirements. We believe the individuals and tasks will be the same as described earlier for the TJC and AOA/HFAP-accredited CAHs. However, the non-accredited CAHs will require more time to accomplish these activities. We estimate that a non-accredited CAH's compliance will require 14 burden hours at a cost of $1,357. For all 892 unaccredited CAHs to comply with this requirement will require an estimated 12,488 burden hours (14 burden hours for each non-accredited CAHs × 892 non-accredited CAHs) at a cost of $1,210,444 ($1,357 estimated cost for each non-accredited CAH × 892 non-accredited CAHs).

Section 485.625(b) will also require CAHs to review and update their emergency preparedness policies and procedures at least annually. As discussed earlier, TJC and AOA/HFAP-accredited CAHs already periodically review their policies and procedures. In addition, the existing CAH CoPs require periodic reviews of the CAH's healthcare policies (§§ 485.627(a), 485.635(a), and 485.641(a)(1)(iii)). Thus, we believe compliance with this requirement will constitute a usual and customary business practice for all CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.625(c) will require CAHs to develop and maintain emergency preparedness communication plans that complied with both federal and state law. We proposed that CAHs review and update these plans at least annually. We proposed that these communication plans include the information listed at § 485.625(c)(1) through (7).

We expect that all CAHs will review their emergency preparedness communication plans and compare them to their risk assessments and emergency plans. We also expect that CAHs will revise and, if necessary, develop new sections that will comply with our requirements. Based on our experience with CAHs, they have some type of emergency preparedness communication plan. Furthermore, it is standard practice for healthcare facilities to maintain contact information for both staff and outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. Thus, we believe that most, if not all, CAHs are already in compliance with § 485.625(c)(1) through (3).

However, all CAHs will need to review and, if needed, revise and update their plans to ensure compliance with § 485.625(c)(4) through (7). The TJC-accredited CAHs are required to establish strategies or plans for emergency communications (CAMCAH, Standard 4.13, p. EC-10b-10c). These plans must cover both internal and external communications and include back-up technologies and communication systems (CAMCAH, Standard 4.13, and EPs 1-14, p. EC-10b-EC-10c). However, we do not believe that these standards will ensure compliance with § 485.625(c)(4) through (7). Thus, we will include the 338 TJC-accredited CAHs in the burden of this final rule.

The AOA/HFAP-accredited CAHs must develop and implement communication plans to ensure the safety of their patients during emergencies (AOA/HFAP Standard 11.02.02). These plans must specifically include both internal and external communications (AOA/HFAP Standard 11.02.02, Elements 6, 7, and 10). Based on these standards, we do not believe they ensure compliance with § 485.625(c)(4) through (7). Thus, we will include these 31 AOA/HFAP-accredited CAHs in the burden of this final rule.

The burden associated with complying with this requirement will be the resources required to develop a communication plan that complied with the requirements of this section. Based on our experience with CAHs, we expect that accomplishing these activities will require the involvement of an administrator, director of nursing, and the facilities director. We expect that the administrator will review the communication plan and make recommendations for necessary changes or additions. The director of nursing and the facilities director will meet with the administrator to discuss and revise or draft new sections for the CAH's existing emergency communication plan. We estimate that complying with this requirement will require 9 burden hours for each CAH at a cost of $831. We estimate that for all 1,337 CAHs to comply with the requirements for an emergency preparedness communication plan will require 12,033 burden hours (9 burden hours for each CAH × 1,337 CAHs) at a cost of $1,111,047 ($831 estimated cost for each CAH × 1,337 CAHs).

Section 485.625(c) also will require CAHs to review and update their emergency preparedness communication plans at least annually. All CAHs are required to evaluate their entire program at least annually (§ 485.641(a)). Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.625(d) will require CAHs to develop and maintain emergency preparedness training and testing programs. We will also require CAHs to review and update their training and testing programs at least annually. We proposed that a CAH comply with the requirements listed at § 485.625(d)(1) and (2).

Regarding § 485.625(d)(1), CAHs will have to provide initial training in emergency preparedness policies and procedures, including prompt reporting and extinguishing fires, protection, and where necessary, evacuation of patients, personnel, and guests, fire prevention, and cooperation with firefighting and disaster authorities, to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the CAH will have to provide emergency preparedness training at least annually.

We expect that all CAHs will review their current training programs and compare them to their risk assessments and emergency preparedness plans, emergency policies and procedures, and emergency communication plans. The CAHs will need to revise and, if necessary, develop new sections or materials to ensure their training and testing programs complied with our requirements.

Current CoPs require CAHs to train their staffs on how to handle emergencies (§ 485.623(c)(1)). However, this training primarily addresses internal emergencies, such as a fire inside the facility. In addition, both TJC and AOA/HFAP require CAHs to provide their staff with training. TJC-accredited CAHs are required to provide their staff with both an initial orientation and on-going training (CAMCAH, Standards HR.2.10 and 2.30, pp. HR-8 and HR—9, respectively). On-going training must also be documented (CAMCAH, Standard HR.2.30, EP 8, p. HR-10). The AOA/HFAP-accredited CAHs are required to provide an education program for their staff and physicians for the CAH's emergency response preparedness (AOA/HFAP Standard 11.07.01). Each CAH also must provide an education program specifically for the CAH's response plan for weapons of mass destruction (AOA Standard 11.07.07).

Thus, we expect that all CAHs provide some emergency preparedness training for their staff. However, neither the current CoPs nor the TJC and AOA/HFAP accreditation standards ensure compliance with all our requirements. All CAHs will need to review their risk assessments, emergency preparedness plans, policies and procedures, and communication plans and then revise or, in some cases, develop new sections for their training programs to ensure compliance with our requirements. They also will need to revise, update, or, in some cases, develop new materials for the initial and ongoing training.

Based on our experience with CAHs, we expect that complying with our requirement will require the involvement of an administrator, the director of nursing, and the facilities director. We expect that the director of nursing will perform the initial review of the training program, brief the administrator and the director of facilities, and revise or develop new sections for the training program, based on the group's decisions. We estimate that each CAH will require 14 burden hours to develop an emergency preparedness training program at a cost of $1,316. Therefore, for all 1,337 CAHs to comply with this requirement will require an estimated 18,718 burden hours (14 burden hours for each CAH × 1,337 CAHs) at a cost of $1,759,492 ($1,316 estimated cost for each CAH × 1,337 CAHs).

Section 485.625(d)(1) also will require CAHs to review and update their emergency preparedness training programs at least annually. Existing regulations require all CAHs to evaluate their entire program at least annually (§ 485.641(a)). Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

The CAHs also will be required to maintain documentation of their training. Based on our experience with CAHs, it is standard practice for them to document the training they provide to staff and other individuals. If a CAH needed to make any changes to their normal business practices to comply with this requirement, the burden will be negligible. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.625(d)(2) will require CAHs to participate in a full-scale exercise and a paper-based, tabletop exercise at least annually. If a full-scale exercise was not available, the CAH will have to conduct a full-scale exercise at least annually. CAHs also will be required to analyze the CAH's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the CAH's emergency plan, as needed. If a CAH experienced an actual natural or man-made emergency that required activation of the emergency plan, it will be exempt from the requirement for a full-scale exercise for 1 year following the onset of the emergency (§ 485.625(d)(2)(ii)). Thus, to meet these requirements, CAHs will need to develop scenarios for each drill and exercise and develop the required documentation.

If a CAH participated in a full-scale exercise, it will likely not need to develop the scenario for that drill. However, for the purpose of determining the burden, we will assume that CAHs need to develop scenarios for both the testing exercises annually.

The TJC-accredited CAHs are required to test their EOP twice a year, either as a planned exercise or in response to an emergency (CAMCAH, Standard EC.4.20, EP 1, p. EC-12). These tests must be monitored, documented, and analyzed (CAMCAH, Standard EC.4.20, EPs 8-19, pp. EC-12-EC-13). Thus, we believe that TJC-accredited CAHs already develop scenarios for these tests. We also expect that they also have developed the documentation necessary to record and analyze their tests and responses to actual emergency events. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for TJC-accredited CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

The AOA/HFAP-accredited CAHs are required to conduct two disaster drills annually (AOA/HFAP Standard 11.07.03). In addition, AOA/HFAP-accredited CAHs are required to participate in weapons of mass destruction drills, as appropriate (AOA/HFAP Standard 11.07.09). We expect that since AOA/HFAP-accredited CAHs already conduct disaster drills, they also develop scenarios for the drills. In addition, it is standard practice in the healthcare industry to document and analyze tests that a facility conducts. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for AOA/HFAP-accredited CAHs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Based on our experience with CAHs, we expect that the 892 non-accredited CAHs already have some type of emergency preparedness training program and conduct some type of drills or exercises to test their emergency preparedness plans. However, this does not ensure that most CAHs already perform the activities needed to comply with our requirements. Thus, we will analyze the burden for these requirements for the 892 non-accredited CAHs.

The 892 non-accredited CAHs will be required to develop scenarios for testing exercises and the documentation necessary to record and later analyze the events that occurred during these tests and actual emergency events. Based on our experience with CAHs, we believe that the same individuals who developed the emergency preparedness training program will develop the scenarios for the tests and the accompanying documentation. We expect that the director of nursing will spend more time than will the other individuals developing the scenarios and the accompanying documentation. We estimate that it will require 8 burden hours for the 892 non-accredited CAHs to comply with these requirements at a cost of $762. Therefore, for all 892 non-accredited CAHs to comply with these requirements will require an estimated 7,136 burden hours (8 burden hours for each non-accredited CAH × 892 non-accredited CAHs) at a cost of $679,704 ($762 estimated cost for each non-accredited CAH × 892 non-accredited CAHs).

O. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 485.727)

Section 485.727(a) will require clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services (organizations) to develop and maintain emergency preparedness plans and review and update the plan at least annually. We are proposing that the plan comply with the requirements listed at § 485.727(a)(1) through (6).

Section 485.727(a)(1) will require organizations to develop documented, facility-based and community-based risk assessment utilizing an all-hazards approach. Organizations will need to identify the medical and non-medical emergency events they could experience both at their facilities and in the surrounding area.

The current CoPs for Organizations require these providers to have “a written plan in operation, with procedures to be followed in the event of fire, explosion, or other disaster” (§ 485.727(a)). To comply with this CoP, we expect that all of these providers have already performed some type of risk assessment during the process of developing their disaster plans and policies and procedures. However, these providers will need to review their current risk assessments and make any revisions to ensure they complied with our requirements.

We have not designated any specific process or format for these providers to use in conducting their risk assessments because we believe that they need the flexibility to determine the best way to accomplish this task. Providers of physical therapy and speech therapy services should include input from all of their major departments in the process of developing their risk assessments. Based on our experience with these providers, we expect that conducting the risk assessment will require the involvement of the organization's administrator and a therapist. The types of therapists at each Organization vary depending upon the services offered by the facility. For the purposes of determining the PRA burden, we will assume that the therapist is a physical therapist. We expect that both the administrator and the therapist will attend an initial meeting, review the current assessment, develop comments and recommendations for changes to the assessment, attend a follow-up meeting, perform a final review, and approve the new risk assessment. We expect that the administrator will coordinate the meetings, review and critique the current risk assessment initially, offer suggested revisions, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approve it. We also expect that the administrator will spend more time reviewing and working on the risk assessment than the physical therapist. We estimate that complying with this requirement will require 9 burden hours at a cost of $901. We estimate that it will require 19,215 burden hours (9 burden hours for each organization × 2,135 organizations) for all organizations to comply with this requirement at a cost of $1,710,135 ($901 estimated cost for each organization × 2,135 organizations).

After conducting the risk assessment, each organization will need to develop and maintain an emergency preparedness plan and review and update it at least annually. Current CoPs require these providers to have a written disaster plan with accompanying procedures for fires, explosions, and other disasters (§ 485.727(a)). The plan must include or address the transfer of casualties and records, the location and use of alarm systems and signals, methods of containing fire, notification of appropriate persons, and evacuation routes and procedures (§ 485.727(a)). Thus, we expect that all of these organizations have some type of emergency preparedness plan and that these plans address many of our requirements. However, all organizations will need to review their current plans and compare them to their risk assessments. Each organization will need to revise, update, and, in some cases, develop new sections to complete a comprehensive emergency preparedness plan that complied with our requirements.

Based on our experience with these organizations, we expect that the administrator and physical therapist who were involved in developing the risk assessment will be involved in developing the emergency preparedness plan. However, we expect it will require more time to complete the plan and that the administrator will be the most heavily involved in reviewing and developing the organization's emergency preparedness plan. We estimate that for each organization to comply will require 12 burden hours at a cost of $1,083. We estimate that it will require 25,620 burden hours (12 burden hours for each organization × 2,135 organizations) to complete the plan at a cost of $2,312,205 ($1,083 estimated cost for each organization × 2,135 organizations).

Each organization will also be required to review and update its emergency preparedness plan at least annually. We believe that these organizations already review their plans periodically. Thus, we believe complying with this requirement will constitute a usual and customary business practice for organizations and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.727(b) will require organizations to develop and implement emergency preparedness policies and procedures based on their risk assessments, emergency plans, communication plans as set forth in § 485.727(a)(1), (a), and (c), respectively. It will also require organizations to review and update these policies and procedures at least annually. At a minimum, we will require that an organization's policies and procedures address the requirements listed at § 485.727(b)(1) through (4).

We expect that all organizations have emergency preparedness policies and procedures. As discussed earlier, the current CoPs require organizations to have procedures within their written disaster plan to be followed for fires, explosions, or other disasters (§ 485.727(a)). In addition, we expect that those procedures already address some of the specific elements required in this section. For example, the current requirements at § 485.727(a)(1) through (4) are similar to our requirements at § 485.727(a)(1) through (5). However, all organizations will need to review their policies and procedures, assess whether their policies and procedures incorporate all of the necessary elements of their emergency preparedness program, and, if necessary, take the appropriate steps to ensure that their policies and procedures are in compliance with our requirements.

We expect that the administrator and the physical therapist will be primarily involved with reviewing and revising the current policies and procedures and, if needed, developing new policies and procedures. We estimate that it will require 10 burden hours for each organization to comply at a cost of $895. We estimate that for all organizations to comply will require 21,350 burden hours (10 burden hours for each organization × 2,135 organizations) at a cost of $1,910,825 ($895 estimated cost for each organization × 2,135 organizations).

We will require organizations to review and update their emergency preparedness policies and procedures at least annually. We believe that these providers already review their emergency preparedness policies and procedures periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.727(c) will require organizations to develop and maintain emergency preparedness communication plans that complied with both federal and state law and will be reviewed and updated at least annually. The communication plan will have to include the information listed at § 485.727(c)(1) through (5).

We expect that all organizations have some type of emergency preparedness communication plan. Current CoPs for these organizations already require them to have a written disaster plan with procedures that must include, among other things, “notification of appropriate persons” (§ 485.727(a)(4)). Thus, we expect that each organization has the contact information they will need to comply with this requirement. In addition, it is standard practice for healthcare facilities to maintain contact information for both staff and outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the facility; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. However, many organizations may not have formal, written emergency preparedness communication plans or their plans may not be fully compliant with our requirements. Therefore, we expect that all organizations will need to review, update, and, in some cases, develop new sections for their plans.

Based on our experience with these organizations, we anticipate that satisfying the requirements in this section will primarily require the involvement of the organization's administrator with the assistance of a physical therapist. We estimate that for each organization to comply will require 8 burden hours at a cost of $722. We estimate that for all 2,135 organizations to comply will require 17,080 burden hours (8 burden hours for each organizations × 2,135 organizations) at a cost of $1,541,470 ($722 estimated cost for each organization × 2,135 organizations).

We are proposing that organizations must review and update their emergency preparedness communication plans at least annually. We believe that these organizations already review their emergency communication plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.727(d) will require organizations to develop and maintain emergency preparedness training and testing programs and review and update these programs at least annually. Specifically, we are proposing that organizations comply with the requirements listed at § 485.727(d)(1) and (2).

According to § 485.727(d)(1), organizations will have to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the CAH will have to provide emergency preparedness training at least annually.

Current CoPs require organizations to ensure that “all employees are trained, as part of their employment orientation, in all aspects of preparedness for any disaster. The disaster program includes orientation and ongoing training and drills for all personnel in all procedures in case of a disaster (42 CFR 485.727(b)). Thus, we expect that organizations already have an emergency preparedness training program for new employees, as well as ongoing training for all staff. However, organizations will need to review their current training programs and compare them to their risk assessments and emergency preparedness plans, policies and procedures, and communication plans. Organizations will need to review, revise, and, in some cases, develop new material for their training programs so that they comply with our requirements.

We expect that complying with this requirement will require the involvement of an administrator and a physical therapist. We expect that the administrator will primarily be involved in reviewing the organization's current training program and the current emergency preparedness program; determining what tasks will need to be performed and what materials will need to be developed to comply with our requirements; and developing the materials for the training program. We expect that the physical therapist will work with the administrator to develop the revised and updated training program. We estimate that it will require 8 burden hours for each organization to develop a comprehensive emergency training program at a cost of $722. Therefore, it will require an estimated 17,080 burden hours (8 burden hours for each organization × 2,135 organizations) to comply with this requirement at a cost of $1,541,470 ($722 estimated cost for each organization × 2,135 organizations).

In § 485.727(d)(1), we also proposed requiring that an organization must review and update its emergency preparedness training program at least annually. We believe that these providers already review their emergency preparedness training programs periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 485.727(d)(2) will require organizations to participate in a full-scale exercise at least annually. They will also be required to conduct one additional exercise of their choice at least annually. If an organization experienced an actual natural or man-made emergency that required activation of its emergency plan, it will be exempt from engaging in a drill for 1 year following the onset of the actual event. Organizations also will be required to analyze their response to and maintain documentation of all the testing exercises and emergency events, and revise their emergency plan, as needed. To comply with this requirement, an organization will need to develop scenarios for their drills and exercises. An organization also will have to develop the documentation necessary for recording and analyzing their responses to the testing exercises and actual emergency events.

The current CoPs require organizations to have a written disaster plan that is periodically rehearsed and have ongoing drills (§ 485.727(a) and (b)). Thus, we expect that all 2,135 organizations currently conduct some type of drill or exercise of their disaster plan. However, the current organizations CoPs do not specify the type of drill, how they are to conduct the drills, or whether the drills should be community-based. In addition, there is no requirement for a paper-based, tabletop exercise. Thus, these requirements do not ensure that organizations will be in compliance with our requirements. Therefore, we will analyze the burden from these requirements for all organizations.

The 2,135 organizations will be required to develop scenarios for testing exercises and the necessary documentation. Based on our experience with organizations, we expect that the same individuals who develop the emergency preparedness training program will develop the scenarios for the drills and exercises and the accompanying documentation. We expect that the administrator will spend more time than the physical therapist developing the scenarios and the documentation. We estimate that for each organization to comply will require 3 burden hours at a cost of $267. Based on that estimate, it will require 6,405 burden hours (3 burden hours for each organization x 2,135 organizations) at a cost of $570,045 ($267 estimated cost for each organization x 2,135 organizations).

P. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 485.920)

Section 485.920(a) will require Community Mental Health Centers (CMHCs) to develop and maintain an emergency preparedness plan that must be reviewed and updated at least annually. Specifically, we proposed that the plan must meet the requirements listed at § 485.920(a)(1) through (4).

We expect all CMHCs to identify the likely medical and non-medical emergency events they could experience within the facility and the community in which it is located and determine the likelihood of the facility experiencing an emergency due to the identified hazards. We expect that in performing the risk assessment, a CMHC will need to consider its physical location, the geographical area in which it is located and its patient population.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment. We expect that most, if not all, CMHCs have already performed at least some of the work needed for a risk assessment because it is standard practice for healthcare organizations to prepare for common emergencies, such as fires, interruptions in communication and power, and storms. However, many CMHCs may not have performed a risk assessment that complies with the requirements. Therefore, we expect that most, if not all, CMHCs will have to perform a thorough review of their current risk assessment and perform the tasks necessary to ensure that the facility's risk assessment complies with the requirements.

We have not designated any specific process or format for CMHCs to use in conducting their risk assessments because we believe CMHCs need maximum flexibility in determining the best way for their facilities to accomplish this task. However, we expect that in the process of developing a risk assessment, healthcare organizations will include representatives from or obtain input from all major departments. Based on our experience with CMHCs, we expect that conducting the risk assessment will require the involvement of the CMHC administrator, a psychiatric registered nurse, and a clinical social worker or mental health counselor. We expect that most of these individuals will attend an initial meeting, review relevant sections of the current assessment, prepare and forward their comments to the administrator, attend a follow-up meeting, perform a final review, and approve the risk assessment. We expect that the administrator will coordinate the meetings, do an initial review of the current risk assessment, critique the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and assure that the necessary parties approve the new risk assessment. It is likely that the CMHC administrator will spend more time reviewing and working on the risk assessment than the other individuals. We estimate that complying with the requirement to conduct a risk assessment will require 10 burden hours for a cost of $788. There are currently 198 CMHCs. Therefore, it will require an estimated 1,980 burden hours (10 burden hours for each CMHC x 198 CMHCs) for all CMHCs to comply with this requirement at a cost of $156,024 ($788 estimated cost for each CMHC × 198 CMHCs).

After conducting the risk assessment, CMHCs will need to develop and maintain an emergency preparedness plan that must be reviewed and updated at least annually. CMHCs will need to compare their current emergency plan, if they have one, to their risk assessment. They will then need to revise and, if necessary, develop new sections of their plan to ensure it complies with the requirements.

It is standard practice for healthcare organizations to make plans for common disasters they may confront, such as fires, interruptions in communication and power, and storms. Thus, we expect that all CMHCs have some type of emergency preparedness plan. However, their plan may not address all likely medical and non-medical emergency events identified by the risk assessment. Furthermore, their plans may not include strategies for addressing likely emergency events or address their patient population, the type of services they have the ability to provide in an emergency, or continuity of operation, including delegations of authority and succession plans. We expect that CMHCs will have to review their current plan and compare it to their risk assessment, as well as to the other requirements in § 485.920(a). We expect that most CMHCs will need to update and revise their existing emergency plan and, in some cases, develop new sections to comply with our requirements.

The burden associated with this requirement will be due to the resources needed to develop an emergency preparedness plan or to review, revise, and develop new sections for an existing emergency plan. Based upon our experience with CMHCs, we expect that the same individuals who were involved in the risk assessment will be involved in developing the emergency preparedness plan. We also expect that developing the plan will require more time to complete than the risk assessment. We expect that the administrator and a psychiatric nurse will spend more time reviewing and developing the CMHC's emergency preparedness plan. We expect that the clinical social worker or mental health counselor will review the plan and provide comments on it to the administrator. We estimate that it will require 15 burden hours for a CMHC to develop its emergency plan at a cost of $1,113. Based on this estimate, it will require 2,970 burden hours (15 burden hours for each CMHC × 198 CMHCs) for all CMHCs to complete their plans at a cost of $220,374 ($1,113 estimated cost for each CMHC × 198 CMHCs).

The CMHC will be required to review and update its emergency preparedness plan at least annually. For the purpose of determining the burden for this requirement, we expect that the CMHCs will review and update their plans annually.

We expect that all CMHCs have an administrator that is responsible for the day-to-day operation of the CMHC. This will include ensuring that all of the CMHC's plans are up-to-date and comply with the relevant federal, state, and local laws, regulations, and ordinances. In addition, it is standard practice in the healthcare industry for facilities to have professional staff persons who periodically review their plans and procedures. However, the current CMHC CoPs do not include a requirement for an emergency preparedness plan and as such, there is no requirement for an annual review of the plan. Therefore, we will analyze the burden from this requirement for all CMHCs.

Based on our experience with CMHCs, we expect that the same individuals who develop the emergency preparedness plan will annually review and update the plan. We expect that the administrator and registered nurse will spend more time than the social worker on the review of the plan and documentation of the plan updates. We estimate that for each CMHC to comply will require 5 burden hours at a cost of $371. Based on that estimate, it will require 990 burden hours (5 burden hours for each organization × 198 organizations) at a cost of $73,458 ($371 estimated cost for each organization × 198 organizations).

Section 485.920(b) will require CMHCs to develop and maintain emergency preparedness policies and procedures based on the emergency plan, the communication plan, and the risk assessment. We also proposed requiring CMHCs to review and update these policies and procedures at least annually. The CMHC's policies and procedures will be required to address, at a minimum, the requirements listed at § 485.920(b)(1) through (7).

We expect that all CMHCs will compare their current emergency preparedness policies and procedures to their emergency preparedness plan, communication plan, and their training and testing program. They will need to review, revise and, if necessary, develop new policies and procedure to ensure they comply with the requirements. The burden associated with reviewing, revising, and updating the CMHC's emergency policies and procedures will be due to the resources needed to ensure they comply with the requirements. We expect that the administrator and the psychiatric registered nurse will be involved with reviewing, revising and, if needed, developing any new policies and procedures. We estimate that for a CMHC to comply with this requirement will require 12 burden hours at a cost of $944. Therefore, for all 198 CMHCs to comply with this requirement will require an estimated 2,376 burden hours (12 burden hours for each CMHC × 198 CMHCs) at a cost of $186,912 ($944 estimated cost for each CMHC × 198 CMHCs).

The CMHCs will be required to review and update their emergency preparedness policies and procedures at least annually. For the purpose of determining the burden for this requirement, we expect that CMHCs will review their policies and procedures annually. We expect that all CMHCs have an administrator who is responsible for the day-to-day operation of the CMHC, which includes ensuring that all of the CMHC's policies and procedures are up-to-date and comply with the relevant federal, state, and local laws, regulations, and ordinances. We also expect that the administrator is responsible for periodically reviewing the emergency preparedness policies and procedures as part of his or her responsibilities. We expect that complying with the requirement for an annual review of the emergency preparedness policies and procedures will constitute a usual and customary business practice for CMHCs. As stated in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2), the time, effort, and financial resources necessary to comply with a collection of information that will be incurred by persons in the normal course of their activities are not subject to the PRA.

Section 485.920(c) will require CMHCs to develop and maintain an emergency preparedness communications plan that complies with both federal and state law. The CMHC also will have to review and update this plan at least annually. The communication plan must include the information listed in § 485.920(c)(1) through (7).

We expect that all CMHCs will compare their current emergency preparedness communications plan, if they have one, to the requirements. CMHCs will need to perform any tasks necessary to ensure that their communication plans were documented and in compliance with the requirements.

We expect that all CMHCs have some type of emergency preparedness communications plan. However, their emergency communications plan may not be thoroughly documented or comply with all of the elements we are requiring. It is standard practice for healthcare organizations to maintain contact information for their staff and for outside sources of assistance; alternate means of communication in case there is a disruption in phone service to the facility (for example, cell phones); and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. However, we expect that all CMHCs will need to review, update, and in some cases, develop new sections for their plans to ensure that those plans include all of the elements we are requiring for CMHC communications plans.

The burden associated with complying with this requirement will be due to the resources required to ensure that the CMHC's emergency communication plan complies with the requirements. Based upon our experience with CMHCs, we expect the involvement of the CMHC's administrator and the psychiatric registered nurse. For each CMHC, we estimate that complying with this requirement will require 8 burden hours at a cost of $637. Therefore, for all of the CMHCs to comply with this requirement will require an estimated 1,584 burden hours (8 burden hours for each CMHC × 198 CMHCs) at a cost of $126,126 ($637 estimated cost for each CMHC × 198 CMHCs).

We expect that CMHCs must also review and update their emergency preparedness communication plan at least annually. For the purpose of determining the burden for this requirement, we expect that CMHCs will review their policies and procedures annually. We expect that all CMHCs have an administrator who is responsible for the day-to-day operation of the CMHC. This includes ensuring that all of the CMHC's policies and procedures are up-to-date and comply with the relevant federal, state, and local laws, regulations, and ordinances. We expect that the administrator is responsible for periodically reviewing the CMHC's plans, policies, and procedures as part of his or her responsibilities. In addition, we expect that an annual review of the communication plan will require only a negligible burden. Complying with the requirement for an annual review of the emergency preparedness communications plan constitutes a usual and customary business practice for CMHCs. As stated in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2), the time, effort, and financial resources necessary to comply with a collection of information that will be incurred by persons in the normal course of their activities are not subject to the PRA.

Section 485.920(d) will require CMHCs to develop and maintain an emergency preparedness training program that must be reviewed and updated at least annually. We will require the CMHC to meet the requirements contained in § 485.920(d)(1) and (2).

We expect that CMHCs will develop a comprehensive emergency preparedness training program. The CMHCs will need to compare their current emergency preparedness training program and compare its contents to the risk assessment and updated emergency preparedness plan, policies and procedures, and communications plan and review, revise, and, if necessary, develop new sections for their training program to ensure it complies with the requirements.

The burden will be due to the resources the CMHC will need to comply with the requirements. We expect that complying with this requirement will include the involvement of a psychiatric registered nurse. We expect that the psychiatric registered nurse will be primarily involved in reviewing the CMHC's current training program, determining what tasks need to be performed or what materials need to be developed, and developing the materials for the training program. We estimate that it will require 10 burden hours for each CMHC to develop a comprehensive emergency training program at a cost of $710. Therefore, it will require an estimated 1,980 burden hours (10 burden hours for each CMHC × 198 CMHCs) to comply with this requirement at a cost of $140,580 ($710 estimated cost for each CMHC × 198 CMHCs).

Section 485.920(d)(1) will also require the CMHCs to review and update their emergency preparedness training program at least annually. For the purpose of determining the burden for this requirement, we will expect that CMHCs will review their emergency preparedness training program annually. We expect that all CMHCs have a professional staff person, probably a psychiatric registered nurse, who is responsible for periodically reviewing their training program to ensure that it is up-to-date and complies with the relevant federal, state, and local laws, regulations, and ordinances. In addition, we expect that an annual review of the CMHC's emergency preparedness training program will require only a negligible burden. Thus, we expect that complying with the requirement for an annual review of the emergency preparedness training program constitutes a usual and customary business practice for CMHCs. As stated in the implementing regulations of the PRA at 5 CFR 1320.3(b)(2), the time, effort, and financial resources necessary to comply with a collection of information that will be incurred by persons in the normal course of their activities are not subject to the PRA.

Section 485.920(d)(2) will require CMHCs to participate in or conduct a full-scale exercise at least annually. CMHCs are also required to participate in one additional testing exercise of their choice at least annually. CMHCs will be required to document the drills and the exercises. To comply with this requirement, a CMHC will need to develop a specific scenario for each drill and exercise. A CMHC will have to develop the documentation necessary to record what happened during the drills and exercises.

Based on our experience with CMHCs, we expect that all 198 CMHCs have some type of emergency preparedness training program and most, if not all, of these CMHCs already conduct some type of drill or exercise to test their emergency preparedness plans. However, we do not know what type of drills or exercises they typically conduct or how often they are performed. We also do not know how, or if, they are documenting and analyzing their responses to these drills and tests. For the purpose of determining a burden for these requirements, we will expect that all CMHCs need to develop two scenarios, one for the drill and one for the exercise, and develop the documentation necessary to record the facility's responses.

The associated burden will be the time and effort necessary to comply with the requirement. We expect that complying with this requirement will likely require the involvement of a psychiatric registered nurse. We expect that the psychiatric registered nurse will develop the documentation necessary for both during the testing exercises and for the subsequent analysis of the CMHC's response. The psychiatric registered nurse will also develop the two scenarios for the drill and exercise. We estimate that these tasks will require 4 burden hours at a cost of $284. For all 198 CMHCs to comply with this requirement will require an estimated 792 burden hours (4 burden hours for each CMHC × 198 CMHCs) at a cost of $56,232 ($284 estimated cost for each CMHC × 198 CMHCs).

Q. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 486.360)

Section 486.360(a) will require Organ Procurement Organizations (OPOs) to develop and maintain emergency preparedness plans that will have to be reviewed and updated at least annually. These plans will have to comply with the requirements listed in § 486.360(a)(1) through (4).

As of June 2016, there are 58 OPOs. The current OPO Conditions for Coverage (CfCs) are located at §§ 486.301 through 486.348. These CfCs do not contain any specific emergency preparedness requirements. Thus, for the purpose of determining the burden, we have analyzed the burden for all 58 OPOs for all of the ICRs contained in this final rule.

Section 486.360(a)(1) will require OPOs to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. OPOs will need to identify the medical and non-medical emergency events they could experience both at their facilities and in the surrounding area, including branch offices and hospitals in their donation services areas.

The burden associated with this requirement will be the time and effort necessary to perform a thorough risk assessment. Based on our experience with OPOs, we believe that all 58 OPOs have already performed at least some of the work needed for their risk assessments. However, these risk assessments may not be documented or may not address all of the elements required under § 486.360(a). Therefore, we expect that all 58 OPOs will have to perform a thorough review of their current risk assessments and perform the necessary tasks to ensure that their risk assessment complied with the requirements of this final rule. Based on our experience with OPOs, we believe that conducting a risk assessment will require the involvement of the OPO's director, medical director, quality assessment and performance improvement (QAPI) director, and an organ procurement coordinator (OPC). We expect that these individuals will attend an initial meeting; review relevant sections of the current assessment, prepare and send their comments to the QAPI director; attend a follow-up meeting; perform a final review; and approve the new risk assessment. We estimate that the QAPI director probably will coordinate the meetings, review the current risk assessment, critique the risk assessment, coordinate comments, develop the new risk assessment, and assure that the necessary parties approved it. We estimate that it will require 10 burden hours for each OPO to conduct a risk assessment at a cost of $1,190. Therefore, for all 58 OPOs to comply with the risk assessment requirement in this section will require an estimated 580 burden hours (10 burden hours for each OPO × 58 OPOs) at a cost of $69,020 ($1,190 estimated cost for each OPO × 58 OPOs).

After conducting the risk assessment, OPOs will then have to develop emergency preparedness plans. The burden associated with this requirement will be the resources needed to develop an emergency preparedness plan that complied with the requirements in § 486.360(a)(1) through (4). We expect that all OPOs have some type of emergency preparedness plan because it is standard practice in the healthcare industry to have a plan to address common emergencies, such as fires. In addition, based on our experience with OPOs (including the performance of the Louisiana OPO during the Katrina disaster), OPOs already have plans to ensure that services will continue to be provided in their donation service areas (DSAs) during an emergency. However, we do not expect that all OPOs will have emergency preparedness plans that will satisfy the requirements of this section. Therefore, we expect that all OPOs will need to review their current emergency preparedness plans and compare their plans to their risk assessments. Most OPOs will need to revise, and in some cases develop, new sections to ensure their plan satisfied the requirements.

We expect that the same individuals who were involved in the risk assessment will be involved in developing the emergency preparedness plan. We expect that these individuals will attend an initial meeting, review relevant sections of the OPO's current emergency preparedness plan, prepare and send their comments to the QAPI director, attend a follow-up meeting, perform a final review, and approve the new plan. We expect that the QAPI Director will coordinate the meetings, perform an initial review of the current emergency preparedness plan, critique the emergency preparedness plan, coordinate comments, ensure that the appropriate individuals revise the plan, and ensure that the necessary parties approve the new plan.

Thus, we estimate that it will require 22 burden hours for each OPO to develop an emergency preparedness plan that complied with the requirements of this section at a cost of $2,568. The difference in burden between the risk assessment and the plan requirement is greater in this section because OPOs have multiple locations and personnel in various locations. Therefore, for all 58 OPOs to comply with this requirement will require an estimated 1,276 burden hours (22 burden hours for each OPO × 58 OPOs) at a cost of $148,944 ($2,568 estimated cost for each OPO × 58 OPOs).

The OPOs will also be required to review and update their emergency preparedness plans at least annually. We believe that all of the OPOs already review their emergency preparedness plans periodically. However, the current OPO CoPs do not include a requirement for an emergency preparedness plan and as such, there is no requirement for an annual review of the plan. Therefore, we will analyze the burden from this requirement for all OPOs.

Based on our experience with OPOs, we expect that the same individuals who develop the emergency preparedness plan will annually review and update the plan. We expect that the QAPI director will spend more time than the director, medical director, and organ procurement coordinator on the review of the plan and documentation of the plan updates. We estimate that for each OPO to comply will require 6 burden hours at a cost of $689. Based on that estimate, it will require 348 burden hours (6 burden hours for each organization × 58 organizations) at a cost of $39,962 ($689 estimated cost for each organization × 58 organizations).

Section 486.360(b) will require OPOs to develop and maintain emergency preparedness policies and procedures based on their risk assessments, emergency preparedness plans, emergency communication plan as set forth in § 486.360(a)(1), (a), and (c), respectively. It will also require OPOs to review and update these policies and procedures at least annually. The OPO's policies and procedures must address the requirements listed at § 486.360(b)(1) and (2).

The OPO CfCs already require the OPOs' governing body to develop and oversee implementation of policies and procedures considered necessary for the effective administration of the OPO, including the OPO's quality assessment and performance improvement (QAPI) program, and services furnished under contract or arrangement, including agreements for those services (§ 486.324(e)). Thus, we expect that OPOs already have developed and implemented policies and procedures for their effective administration. However, since the current CfCs have no specific requirement that these policies and procedures address emergency preparedness, we do not believe that the OPOs have developed or implemented all of the policies and procedures that will be needed to comply with the requirements of this section.

The burden associated with the development of the emergency preparedness policies and procedures will be the resources needed to develop emergency preparedness policies and procedures that will include, but will not be limited to, the specific elements identified in this requirement. We expect that all OPOs will need to review their current policies and procedures and compare them to their risk assessments, emergency preparedness plans, emergency communication plans, and agreements and protocols; they have developed as required by this final rule. Following their reviews, OPOs will need to develop and implement the policies and procedures necessary to ensure that they initiate and maintain their emergency preparedness plans, agreements, and protocols.

Based on our experience with OPOs, we expect that accomplishing these activities will require the involvement of the OPO's director, medical director, QAPI director, and an Organ Procurement Coordinator (OPC). We expect that all of these individuals will review the OPO's current policies and procedures; compare them to the risk assessment, emergency preparedness plan, agreements and protocols they have established with hospitals, other OPOs, and transplant programs; provide an analysis or comments; and participate in developing the final version of the policies and procedures.

We expect that the QAPI director will likely coordinate the meetings; coordinate and incorporate comments; draft the revised or new policies and procedures; and obtain the necessary signatures for final approval. We estimate that it will require 20 burden hours for each OPO to comply with the requirement to develop emergency preparedness policies and procedures at a cost of $2,154. Therefore, for all 58 OPOs to comply with this requirement will require an estimated 1,160 burden hours (20 burden hours for each OPO × 58 OPOs) at a cost of $124,932 (estimated cost for each OPO of $2,154 × 58 OPOs).

The OPOs also will be required to review and update their emergency preparedness policies and procedures at least annually. We believe that OPOs already review their emergency preparedness policies and procedures periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 486.360(c) will require OPOs to develop and maintain emergency preparedness communication plans that complied with both federal and state law. The OPOs will have to review and update their plans at least annually. The communication plans will have to include the information listed in § 486.360(c)(1) through (3).

The OPOs must operate 24 hours a day, 7 days a week. OPOs conduct much of their work away from their office(s) at various hospitals within their DSAs. To function effectively, OPOs must ensure that they and their staff at these multiple locations can communicate with the OPO's office(s), other OPO staff members, transplant and donor hospitals, transplant programs, the Organ Procurement and Transplantation Network (OPTN), other healthcare providers, other OPOs, and potential and actual donors' next-of-kin.

Thus, we expect that the nature of their work will ensure that all OPOs have already addressed at least some of the elements that will be required by this section. For example, due to the necessity of communication with so many other entities, we expect that all OPOs will have compiled names and contact information for staff, other OPOs, and transplant programs.

We also expect that all OPOs will have alternate means of communication for their staffs. However, we do not believe that all OPOs have developed formal plans that include all of the elements contained in this requirement. The burden will be the resources needed to develop an emergency preparedness communications plan that will include, but not be limited to, the specific elements identified in this section. We expect that this will require the involvement of the OPO director, medical director, QAPI director, and OPC. We expect that all of these individuals will need to review the OPO's current plans, policies, and procedures related to communications and compare them to the OPO's risk assessment, emergency plan, and the agreements and protocols the OPO developed in accordance with § 486.360(e), and the OPO's emergency preparedness policies and procedures. We expect that these individuals will review the materials described earlier, submit comments to the QAPI director, review revisions and additions, and give a final recommendation or approval for the new emergency preparedness communication plan. We also expect that the QAPI director will coordinate the meetings; compile comments; incorporate comments into a new communications plan, as appropriate; and ensure that the necessary individuals review and approve the new plan.

We estimate that it will require 14 burden hours to develop an emergency preparedness communication plan at a cost of $1,566. Therefore, it will require an estimated 812 burden hours (14 burden hours for each OPO × 58 OPOs) at a cost of $90,828 ($1,566 estimated cost for each OPO × 58 OPOs).

We proposed that OPOs must review and update their emergency preparedness communication plans at least annually. We believe that all of the OPOs already review their emergency preparedness communication plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for OPOs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 486.360(d) will require OPOs to develop and maintain emergency preparedness training and testing programs. OPOs also will be required to review and update these programs at least annually. In addition, OPOs must meet the requirements listed in § 486.360(d)(1) and (2).

In § 486.360(d)(1), we proposed that OPOs be required to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of that training. OPOs must also ensure that their staff can demonstrate knowledge of their emergency procedures. Thereafter, OPOs will have to provide emergency preparedness training at least annually.

Under existing regulations, OPOs are required to provide their staffs with the training and education necessary for them to furnish the services the OPO is required to provide, including applicable organizational policies and procedures and QAPI activities (§ 486.326(c)). However, since there are no specific emergency preparedness requirements in the current OPO CfCs, we do not believe that the content of their existing training will comply with the requirements.

We expect that OPOs will develop a comprehensive emergency preparedness training program for their staffs. Based upon our experience with OPOs, we expect that complying with this requirement will require the OPO director, medical director, the QAPI director, an OPC, and the education coordinator. We expect that the QAPI director and the education coordinator will review the OPO's risk assessment, emergency preparedness plan, policies and procedures, and communication plan and make recommendations regarding revisions or new sections necessary to ensure that all appropriate information is included in the OPO's emergency preparedness training. We believe that the OPO director, medical director, and OPC will meet with the QAPI director and education coordinator and assist in the review, provide comments, and approve the new emergency preparedness training program.

We estimate that it will require 40 burden hours for each OPO to develop an emergency preparedness training program that complied with these requirements at a cost of $3,154. Therefore, we estimate that for all 58 OPOs to comply with this requirement will require 2,320burden hours (40 burden hours for each OPO × 58 OPOs) at a cost of $203,812 ($3,514 estimated cost for each OPO × 58 OPOs).

We proposed that OPOs must review and update their emergency preparedness training programs at least annually. We believe that all of the OPOs already review their emergency preparedness training programs periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for OPOs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 486.360(d)(2) will require OPOs to conduct a paper-based, tabletop exercise at least annually. OPOs also will be required to analyze their responses to and maintain documentation of all tabletop exercises and actual emergency events, and revise their emergency plans, as needed. To comply with this requirement, OPOs will have to develop scenarios for each tabletop exercise and the necessary documentation.

The OPO CfCs do not currently contain a requirement for OPOs to conduct a paper-based, tabletop exercise. However, OPOs are required to evaluate their staffs' performance and provide training to improve individual and overall staff performance and effectiveness (42 CFR 486.326(c)). Therefore, we expect that OPOs periodically conduct some type of exercise to test their plans, policies, and procedures, which will include developing a scenario for and documenting the exercise. Thus, we believe compliance with these requirements will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

We expect that the QAPI director and the education coordinator will work together to develop the scenario for the exercise and the necessary documentation. We expect that the QAPI director will likely spend more time on these activities. We estimate that these tasks will require 5 burden hours for each OPO at a cost of $408. For all 58 OPOs to comply with these requirements will require an estimated 290 burden hours (5 burden hours for each OPO × 58 OPOs) at a cost of $23,664 ($408 estimated cost for each OPO × 58 OPOs).

Section 486.360(e) requires OPOs to develop and maintain mutually agreed upon protocols as required in § 486.344(d) that cover the duties and responsibilities of the transplant program, the hospital in which the transplant program is operated and the OPO during an emergency. Section 486.344(d) does not currently require that emergency preparedness be addressed in those protocols. Thus, we believe that most OPOs do not currently address emergency preparedness in their protocols. OPOs will only be required to address emergency preparedness with the transplant centers and the hospitals in which they operate. Since the number of transplant hospitals varies between the DSAs and the number of transplant programs in each of those hospitals also varies, we have estimated the burden based on the average number of transplant hospitals for each DSA and the number of transplant programs in those hospitals. There are about 770 transplant programs and 234 transplant hospitals. For each OPO's DSA, there is an average of 4 transplant hospitals (234 transplant hospitals/58 OPOs) with 3 transplant programs (770 transplant programs/234 transplant hospitals). Thus, we estimate that each OPO would need to develop protocols for 12 transplant programs (4 transplant hospitals for each DSA × 3 transplant programs in each transplant hospital).

The burden associated with this requirement will be the time and effort necessary to negotiate with each hospital and transplant program, and then draft the protocols that address each one's duties and responsibilities during an emergency. Based on our experience with OPOs, transplant centers, and the hospitals in which they operate, we believe that they have already had to deal with some type of emergency and have a basis for those protocols, especially the types of services that are needed by the waiting list patients and the transplant recipients and the services that each of them can provide during an emergency. Based on our experience with OPOs, we believe that conducting these negotiations would require the involvement of the OPO's director, medical director, QAPI director, and an organ procurement coordinator (OPC). We expect that these individuals would attend an initial meeting and then one individual, probably the QAPI director, would draft the protocols and ensure they are reviewed by all required parties and agreed to. This would require an hour of each individual's time, except for the QAPI director who would require 2 hours for each transplant program. Thus, for each transplant program, the OPO would need 5 burden hours at a cost of $595. As described previously, each OPO would need to develop protocols for 12 transplant programs. Thus, to comply with this requirement, each OPO would require 60 burden hours (5 burden hours × 12 transplant programs) at a cost of $7,140 ($595 for each transplant program × 12 transplant programs). For all 58 OPOs, we estimate that the total burden to develop these protocols would be 3,480 burden hours (60 burden hours for each OPO × 58 OPOs) at a cost of $414,120 ($7,140 for each OPO × 58 OPOs).

Section 486.360(e) will also require each OPO to have the capability to continue its operations from an alternate location during an emergency. The OPO can have an agreement with one or more other OPOs to provide essential organ procurement services to all or a portion of the OPO's DSA in the event that the OPO cannot provide such services due to an emergency. However, based upon comments that we received, we are also finalizing two alternate means by which an OPO can also comply with this requirement. An OPO with more than one location or office would satisfy this requirement if it had at least one other location or office from which the OPO could conduct its operations, or at least those services the OPO has deemed essential to provide, during an emergency. An OPO could also satisfy this requirement by having a plan, which has been positively tested, to locate to an alternate location during an emergency as part of its emergency plan as required by § 486.360(a). According to the commenters, some OPOs, especially those in DSAs that cover large geographical areas, already have more than one office or location. In addition, since OPOs will have to address continuity of operations in their emergency plans under § 486.360(a), we believe that virtually all of the OPOs will chose to comply with this requirement by one of the two alternate methods being finalized. We estimate that about 9 OPOs or 15 percent of all OPOs would chose to have an agreement with another OPO. Since we estimate that fewer than 10 OPOs would chose to have an agreement with another OPO, this requirement is not subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(c).

R. ICRs Regarding Condition for Coverage and Condition for Certification: Emergency Preparedness (§ 491.12)

Section 491.12(a) will require Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs) to develop and maintain emergency preparedness plans. The RHCs and FQHCs will also have to review and update their plans at least annually. We proposed that the plan must meet the requirements listed at § 491.12(a)(1) through (4).

Section 491.12(a)(1) will require RHCs/FQHCs to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. RHCs/FQHCs will need to identify the medical and non-medical emergency events they could experience both at their facilities and in the surrounding area. RHCs/FQHCs will need to review any existing risk assessments and then update and revise those assessments or develop new sections for them so that those assessments complied with our requirements.

We obtained the total number of RHCs and FQHCs used in this burden analysis from the CMS CASPER data system, which the states update periodically. Due to variations in the timeliness of the data submission, all numbers in this analysis are approximate. There are currently 11,500 RHC/FQHCs (4,200 RHCs + 7,300 FQHCs). Unlike RHCs, FQHCs are grantees and look-alikes under HRSA's Health Center Program. In 2007, the Health Resources and Services Administration (HRSA) issued a Policy Information Notice (PIN) entitled “Health Center Emergency Management Program Expectations,” that detailed the expectations HRSA has for health centers related to emergency management (“Health Center Emergency Management Program Expectations,” Policy Information Notice (PIN), Document Number 2007-15, HRSA, August 22, 2007) (Emergency Management PIN). A review of the Emergency Management PIN indicates that some of its expectations are very similar to the requirements in this final rule. While the expectations set forth by HRSA in the Emergency Management PIN are not requirements for receiving a HRSA Center Program grant (and as such are not requirements for FQHCs), if HRSA finds that an FQHC is not meeting the expectations of the Emergency Management PIN, it would provide the FQHC with resources for technical assistance to assist them in meeting these expectations. This demonstrates the importance of the FQHC's compliance with the Emergency Management PIN guidance. Therefore, since the expectations in the Emergency Management PIN are a significant factor in determining the burden for FQHCs, we will analyze the burden for the 7,300 FQHCs separately from the 4,200 RHCs where the burden will be significantly different.

Based on our experience with RHCs, we expect that all 4,200 RHCs have already performed at least some of the work needed to conduct a risk assessment. It is standard practice for healthcare facilities to prepare for common emergencies, such as fires, power outages, and storms. In addition, the current Rural Health Clinic Conditions for Certification and the FQHC Conditions for Coverage (RHC/FQHC CfCs) already require each RHC and FQHC to assure the safety of patients in case of non-medical emergencies by taking other appropriate measures that are consistent with the particular conditions of the area in which the clinic or center is located (§ 491.6(c)(3)).

Furthermore, in accordance with the Emergency Management PIN, FQHCs should have initiated their “emergency management planning by conducting a risk assessment such as a Hazard Vulnerability Analysis” (HVA) (Emergency Management PIN, p. 5). The HVA should identify potential emergencies or risks and potential direct and indirect effects on the facility's operations and demands on their services and prioritize the risks based on the likelihood of each risk occurring and the impact or severity the facility will experience if the risk occurs (Emergency Management PIN, p. 5). FQHCs are also “encouraged to participate in community level risk assessments and integrate their own risk assessment with the local community” (Emergency Management PIN, p. 5).

Despite these expectations and the existing Medicare regulations for RHCs/FQHCs, some RHC/FQHC risk assessments may not comply with all requirements. For example, the expectations for FQHCs do not specifically address our requirement to address likely medical and non-medical emergencies. In addition, participation in a community-based risk assessment is only encouraged, not required. We expect that all 4,200 RHCs and 6,502 FQHCs will need to compare their current risk assessments with our requirements and accomplish the tasks necessary to ensure their risk assessments comply with our requirements. However, we expect that FQHCs will not be subject to as many burden hours as RHCs.

We have not designated any specific process or format for RHCs or FQHCs to use in conducting their risk assessments because we believe that RHCs and FQHCs need flexibility to determine the best way to accomplish this task. However, we expect that these healthcare facilities will include input from all of their major departments. Based on our experience with RHCs/FQHCs, we expect that conducting the risk assessment will require the involvement of the RHC/FQHC's administrator, a physician, a nurse practitioner or physician assistant, and a registered nurse. We expect that these individuals will attend an initial meeting, review the current risk assessment, prepare and forward their comments to the administrator, attend a follow-up meeting, perform a final review, and approve the new risk assessment. We expect that the administrator will coordinate the meetings, review the current risk assessment, provide an analysis of the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and ensure that the necessary parties approve it. We also expect that the administrator will spend more time reviewing the risk assessment than the other individuals.

We estimate that it will require 10 burden hours for each RHC to conduct a risk assessment that complied with the requirements in this section at a cost of $1,080. We estimate that for all RHCs to comply with our requirements will require 42,000 burden hours (10 burden hours for each RHC × 4,200 RHCs) at a cost of $4,536,000 ($1,080 estimated cost for each RHC × 4,200 RHCs).

We estimate that it will require 5 burden hours for each FQHC to conduct a risk assessment that complied with our requirements at a cost of $520. We estimate that for all 7,300 FQHCs to comply will require 36,500 burden hours (5 burden hours for each FQHC × 7,300 FQHCs) at a cost of $3,796,000 ($520 estimated cost for each FQHC × 7,300 FQHCs). Based on those estimates, compliance with this requirement for all RHCs and FQHCs will require 78,500 burden hours at a cost of $8,332,000.

After conducting the risk assessment, RHCs/FQHCs will have to develop and maintain emergency preparedness plans that complied with § 491.12(a)(1) through (4) and review and update them annually. It is standard practice for healthcare facilities to plan for common emergencies, such as fires, hurricanes, and snowstorms. In addition, as discussed earlier, we require all RHCs/FQHCs to take appropriate measures to ensure the safety of their patients in non-medical emergencies, based on the particular conditions present in the area in which they are located (§ 491.6(c)(3)). Thus, we expect that all RHCs/FQHCs have developed some type of emergency preparedness plan. However, under this final rule, all RHCs/FQHCs will have to review their current plans and compare them to their risk assessments. The RHCs/FQHCs will need to update, revise, and, in some cases, develop new sections to complete their emergency preparedness plans that meet our requirements.

The Emergency Management PIN contains many expectations for an FQHC's emergency management plan (EMP). For example, it states that the FQHC's EMP “is necessary to ensure the continuity of patient care” during an emergency (Emergency Management PIN, p. 6) and should contain plans for “assuring access for special populations (Emergency Management PIN, p. 7). The FQHC's EMP also should address continuity of operations, as appropriate (Emergency Management PIN, p. 6). In addition, FQHCs should use an “all-hazards approach” so that these facilities can respond to all of the risks they identified in their risk assessment (Emergency Management PIN, p. 6). Based on the expectations in the Emergency Management PIN, we expect that FQHCs likely have developed emergency preparedness plans that comply with many, if not all, of the elements with which their plans will need to comply under this final rule. However, we expect that FQHCs will need to compare their current EMP to our requirements and, if necessary, revise or develop new sections for their EMP to bring it into compliance. We expect that FQHCs will have less of a burden than RHCs.

Based on our experience with RHCs/FQHCs, we expect that the same individuals who were involved in developing the risk assessments will be involved in developing the emergency preparedness plans. However, we expect that it will require more time to complete the plans than the risk assessments. We expect that the administrator will have primary responsibility for reviewing and developing the RHC/FQHC's EMP. We expect that the physician, nurse practitioner or physician assistant, and registered nurse will review the draft plan and provide comments to the administrator. We estimate that for each RHC to comply with this requirement will require 14 burden hours at a cost of $1,379. Therefore, it will require an estimated 58,800 burden hours (14 burden hours for each RHC × 4,200 RHCs) to complete the plan at a cost of $5,791,800 ($1,379 estimated cost for each RHC × 4,200 RHCs).

We estimate that it will require 8 burden hours for each FQHC to comply with our requirements at a cost of $762. Based on that estimate, it will require 58,400 burden hours (8 burden hours for each FQHC × 7,300 FQHCs) to complete the plan at a cost of $5,562,600 ($762 estimated cost for each FQHC × 7,300 FQHCs).

Based on the previous estimates, for all RHCs and FQHCs to develop an emergency preparedness plan that complies with our requirements will require 117,200 burden hours at a cost of $11,354,400.

Each RHC/FQHC also will be required to review and update its emergency preparedness plan at least annually. We believe that RHCs and FQHCs already review their emergency preparedness plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for RHCs and FQHCs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 491.12(b) will require RHCs/FQHCs to develop and implement emergency preparedness policies and procedures based on their emergency plans, risk assessments, and communication plans as set forth in § 491.12(a), (a)(1), and (c), respectively. We will also require RHCs/FQHCs to review and update these policies and procedures at least annually. At a minimum, we will require that the RHC/FQHC's policies and procedures address the requirements listed at § 491.12(b)(1) through (4).

We expect that all RHCs/FQHCs have some emergency preparedness policies and procedures. All RHCs and FQHCs are required to have emergency procedures related to the safety of their patients in non-medical emergencies (§ 491.6(c)). They also must set forth in writing their organization's policies (§ 491.7(a)(2)). In addition, current regulations require that a physician, in conjunction with a nurse practitioner or physician's assistant, develop the facility's written policies (§ 491.8(b)(ii) and (c)(i)). However, we expect that all RHCs/FQHCs will need to review their policies and procedures, assess whether their policies and procedures incorporate their risk assessments and emergency preparedness plans and make any changes necessary to comply with our requirements.

We expect that FQHCs already have policies and procedures that will comply with some of our requirements. Several of the expectations of the Emergency Management PIN address specific elements in § 491.12(b). For example, the PIN states that FQHCs should address, as appropriate, continuity of operations, staffing, surge patients, medical and non-medical supplies, evacuation, power supply, water and sanitation, communications, transportation, and the access to and security of medical records (Emergency Management PIN, p. 6). In addition, FQHCs should also continually evaluate their EMPs and make changes to their EMPs as necessary (Emergency Management PIN, p. 7). These expectations also indicate that FQHCs should be working with and integrating their planning with their state and local communities' plans, as well as other key organizations and other relationships (Emergency Management PIN, p. 8). Thus, we expect that burden for FQHCs from the requirement for emergency preparedness policies and procedures will be less than the burden for RHCs.

The burden associated with our requirements will be reviewing, revising, and, if needed, developing new emergency preparedness policies and procedures. We expect that a physician and a nurse practitioner will primarily be involved with these tasks and that an administrator will assist them. We estimate that for each RHC to comply with our requirements will require 12 burden hours at a cost of $1,482. Based on that estimate, for all 4,200 RHCs to comply with these requirements will require 50,400 burden hours (12 burden hours for each RHC × 4,200 RHCs) at a cost of $6,224,400 ($1,482 estimated cost for each RHC × 4,200 RHCs).

As discussed earlier, we expect that FQHCs will have less of a burden from developing their emergency preparedness policies and procedures due to the expectations set out in the Emergency Management PIN. Thus, we estimate that for each FQHC to comply with the requirements will require 8 burden hours at a cost of $932. Based on that estimate, for all 7,300 FQHCs to comply with these requirements will require 58,400 burden hours (8 burden hours for each FQHC × 7,300 FQHCs) at a cost of $6,803,600 ($932 estimated cost for each FQHC × 7,300 FQHCs).

Based on the previous estimates, for all RHCs and FQHCs to develop emergency preparedness policies and procedures that comply with our requirements will require 108,800 burden hours at a cost of $13,028,000.

We proposed that RHCs/FQHCs review and update their emergency preparedness policies and procedures at least annually. We believe that RHCs and FQHCs already review their emergency preparedness policies and procedures periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for RHCs/FQHCs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 491.12(c) will require RHCs/FQHCs to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. RHCs/FQHCs will also have to review and update these plans at least annually. We proposed that the communication plan must include the information listed in § 491.12(c)(1) through (5).

We expect that all RHCs/FQHCs have some type of emergency preparedness communication plan. It is standard practice for healthcare facilities to maintain contact information for staff and outside sources of assistance; alternate means of communication in case there is an interruption in the facility's phone services; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for patients. As discussed earlier, RHCs and FQHCs are required to take appropriate measures to ensure the safety of their patients during non-medical emergencies (§ 491.6(c)). We expect that an emergency preparedness communication plan will be an essential element in any emergency preparedness preparations. However, some RHCs/FQHCs may not have a formal, written emergency preparedness communication plan or their plan may not include all the requirements we proposed.

The Emergency Management PIN contains specific expectations for communications and information sharing (Emergency Management PIN, pp. 8-9). “A well-defined communication plan is an important component of an effective EMP” (Emergency Management PIN, p. 8). In addition, FQHCs are expected to have policies and procedures for communicating with both internal stakeholders (such as patients and staff) and external stakeholders (such as federal, tribal, state, and local agencies), and for identifying who will do the communicating and what type of information will be communicated (Emergency Management PIN, p. 8). FQHCs should also identify alternate communications systems in the event that their standard communications systems become unavailable, and the FQHC should identify these alternate systems in their EMP (Emergency Management PIN, p. 9). Thus, we expect that all FQHCs will have a formal communication plan for emergencies and that those plans will contain some of our requirements. However, we expect that all FQHCs will need to review, revise, and, if needed, develop new sections for their emergency preparedness communication plans to ensure that their plans are in compliance. We expect that these tasks will require less of a burden for FQHCs than for the RHCs.

The burden associated with complying with this requirement will be the resources required to review, revise, and, if needed, develop new sections for the RHC/FQHC's emergency preparedness communication plan. Based on our experience with RHCs/FQHCs, as well as the requirements in current regulations for a physician to work in conjunction with a nurse practitioner or a physician assistant to develop policies, we anticipate that satisfying the requirements in this section will require the involvement of the RHC/FQHC's administrator, a physician, and a nurse practitioner or physician assistant. We expect that the administrator and the nurse practitioner or physician assistant will be primarily involved in reviewing, revising, and if needed, developing new sections for the RHC/FQHC's emergency preparedness communication plan.

We estimate that for each RHC to comply with the requirements will require 10 burden hours at a cost of $1,126. Based on that estimate, for all 4,200 RHCs to comply will require 42,000 burden hours (10 burden hours for each RHC × 4,200 RHCs) at a cost of $4,729,200 ($1,126 estimated cost for each RHC × 4,200 RHCs).

We estimate that for a FQHC to comply with the requirements will require 5 burden hours at a cost of $563. Based on this estimate, for all 7,300 FQHCs to comply will require 36,500 burden hours (5 burden hours for each FQHC × 7,300 FQHCs) at a cost of $4,109,900 ($563 estimated cost for each FQHC × 7,300 FQHCs).

We proposed that RHCs/FQHCs also review and update their emergency preparedness communication plans at least annually. We believe that RHCs/FQHCs already review their emergency preparedness communication plans periodically. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for RHCs/FQHCs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 491.12(d) will require RHCs/FQHCs to develop and maintain emergency preparedness training and testing programs and review and update these programs at least annually. We proposed that an RHC/FQHC will have to comply with the requirements listed in § 491.12(d)(1) and (2).

Section 491.12(d)(1) will require each RHC and FQHC to provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of that training. Each RHC and FQHC will also have to ensure that its staff could demonstrate knowledge of those emergency procedures. Thereafter, each RHC and FQHC will be required to provide emergency preparedness training annually.

Based on our experience with RHCs and FQHCs, we expect that all 11,500 RHC/FQHCs already have some type of emergency preparedness training program. The current RHC/FQHC regulations require RHCs and FQHCs to provide training to their staffs on handling emergencies (§ 491.6(c)(1)). In addition, FQHCs are expected to provide ongoing training in emergency management and their facilities' EMP to all of their employees (Emergency Management PIN, p. 7). However, neither the current regulations nor the PIN's expectations for FQHCs address initial training and ongoing training, frequency of training, or requirements that individuals providing services under arrangement and volunteers be included in the training. RHCs/FQHCs will need to review their current training programs; compare their contents to their risk assessments, emergency preparedness plans, policies and procedures, and communication plans and then take the necessary steps to ensure that their training programs comply with our requirements.

We expect that each RHC and FQHC has a professional staff person who is responsible for ensuring that the facility's training program is up-to-date and complies with all federal, state, and local laws and regulations. This individual will likely be an administrator. We expect that the administrator will be primarily involved in reviewing the RHC/FQHC's emergency preparedness program; determining what tasks need to be performed and what materials need to be developed to bring the training program into compliance with our requirements; and making changes to current training materials and developing new training materials. We expect that the administrator will work with a registered nurse to develop the revised and updated training program. We estimate that it will require 10 burden hours for each RHC or FQHC to develop a comprehensive emergency training program at a cost of $602. Therefore, it will require an estimated 115,500 burden hours (10 burden hours for each RHC/FQHC × 11,500 RHCs/FQHCs) to comply with this requirement at a cost of $6,923,000 ($602 estimated cost for each RHC/FQHC × 11,500 RHCs/FQHCs).

Section 491.12(d) will also require that RHCs/FQHCs develop and maintain emergency preparedness training and testing programs that will be reviewed and updated at least annually. We believe that RHCs/FQHCs already review their emergency preparedness programs periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice for RHCs/FQHCs and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 491.12(d)(2) will require RHCs/FQHCs to participate in a full-scale exercise at least annually. They will also be required to participate in an additional testing exercise of their choice at least annually. RHCs/FQHCs will also be required to analyze their responses to and maintain documentation of drills, tabletop exercises, and emergency events, and revise their emergency plans, as needed. If an RHC or FQHC experienced an actual natural or man-made emergency that required activation of its emergency plan, it will be exempt from the requirement for a community or individual, facility-based full-scale exercise for 1 year following the onset of the actual event. However, for purposes of determining the burden for these requirements, we will assume that all RHCs/FQHCs will have to comply with all of these requirements.

The burden associated with complying with these requirements will be the resources the RHC or FQHC will need to develop the scenarios for the drill and exercise and the documentation necessary for analyzing and documenting their drills, tabletop exercises, as well as any emergency events.

Based on our experience with RHCs/FQHCs, we expect that most of the 11,500 RHCs/FQHCs already conduct some type of testing of their emergency preparedness plans and develop scenarios and documentation for their testing and emergency events. For example, FQHCs are expected to conduct some type of testing of their EMP at least annually (Emergency Management PIN, p. 7). However, we do not believe that all RHCs/FQHCs have the appropriate documentation for the testing exercises and emergency events or that they conduct both two testing exercises annually. Thus, we will analyze the burden associated with these requirements for all 11,500 RHCs/FQHCs.

Based on our experience with RHCs/FQHCs, we expect that the same individuals who are responsible for developing the RHC/FQHC's training and testing program will develop the scenarios for the drills and exercises and the accompanying documentation. We expect that the administrator and a registered nurse will be primarily involved in accomplishing these tasks. We estimate that for each RHC/FQHC to comply with the requirements in this section will require 5 burden hours at a cost of $347. Based on this estimate, for all 11,500 RHCs/FQHCs to comply with the requirements in this section will require 57,500 burden hours (5 burden hours for each RHC/FQHC × 11,500 RHCs/FQHCs) at a cost of $3,990,500 ($347 estimated cost for each RHC/FQHC × 11,500 RHC/FQHCs).

S. ICRs Regarding Condition of Participation: Emergency Preparedness (§ 494.62)

Section 494.62(a) will require dialysis facilities to develop and maintain emergency preparedness plans that will have to reviewed and updated at least annually. Section 494.62 will require that the plan include the elements set out at § 494.62(a)(1) through (4).

Section 494.62(a)(1) will require dialysis facilities to develop a documented, facility-based and community-based risk assessment utilizing an all-hazards approach. The risk assessment should address the medical and non-medical emergency events the facility could experience both within the facility and within the surrounding area. The dialysis facility will have to consider its location and geographical area; patient population, including, but not limited to, persons-at-risk; and the types of services the dialysis facility has the ability to provide in an emergency. The dialysis facility also will need to identify the measures it will need to take to ensure the continuity of its operations, including delegations of authority and succession plans.

The burden associated with this requirement will be the resources needed to perform a thorough risk assessment. The current CfCs already require dialysis facilities to implement processes and procedures to manage medical and nonmedical emergencies that are likely to threaten the health or safety of the patients, the staff, or the public. These emergencies include, but are not limited to, fire, equipment or power failure, care-related emergencies, water supply interruption, and natural disasters likely to occur in the facility's geographic area (§ 494.60(d)). Thus, to be in compliance with this CfC, we believe that all dialysis facilities will have already performed some type of risk assessment during the process of developing their emergency preparedness processes and procedures. However, these risk assessments may not be as thorough or address all of the elements required in § 494.62(a). For example, the current CfCs do not require dialysis facilities to plan for man-made disasters. Therefore, we believe that all dialysis facilities will have to conduct a thorough review of their current risk assessments and then perform the necessary tasks to ensure that their facilities' risk assessments complied with the requirements of this section.

Based on our experience with dialysis facilities, we expect that conducting the risk assessment will require the involvement of the dialysis facility's chief executive officer or administrator, medical director, nurse manager, social worker, and a patient care technician (PCT). We believe that all of these individuals will attend an initial meeting, review relevant sections of the current assessment, develop comments and recommendations for changes to the assessment, attend a follow-up meeting, perform a final review and approve the risk assessment. We believe that the administrator will probably coordinate the meetings, do an initial review of the current risk assessment, provide a critique of the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and assure that the necessary parties approve the new risk assessment. We also believe that the administrator will probably spend more time reviewing and working on the risk assessment than the other individuals involved in performing the risk assessment. Thus, we estimate that complying with this requirement to conduct and develop a risk assessment will require 12 burden hours at a cost of $1,206. There are currently 6,648 dialysis facilities. Therefore, it will require an estimated 79,776 burden hours (12 burden hours for each dialysis facility × 6,648 dialysis facilities) for all dialysis facilities to comply with this requirement at a cost of $8,017,488 ($1,206 estimated cost for each dialysis facility × 6,648 dialysis facilities).

After conducting the risk assessment, each dialysis facility will then have to develop and maintain an emergency preparedness plan that the facility must evaluate and update at least annually. This emergency plan will have to comply with the requirements at § 494.62(a)(1) through (4).

Current CfCs already require dialysis facilities to have a plan to obtain emergency medical system assistance when needed and to evaluate at least annually the effectiveness of emergency and disaster plans and update them as necessary (§ 494.60(d)(4)). Thus, we expect that all dialysis facilities have some type of emergency preparedness or disaster plan. In addition, dialysis facilities must implement processes and procedures to manage medical and nonmedical emergencies that are likely to threaten the health or safety of the patients, the staff, or the public. These emergencies include, but are not limited to, fire, equipment or power failures, care-related emergencies, water supply interruption, and natural disasters likely to occur in the facility's geographic area (§ 494.60(d)). We expect that the facility will incorporate many, if not all, of these processes and procedures into its emergency preparedness plan. We expect that each dialysis facility has some type of emergency preparedness plan and that plan should already address many of these requirements. However, all of the dialysis facilities will have to review their current plans and compare them to the risk assessment they performed according to § 494.62(a)(1). The dialysis facility will then need to update, revise, and, in some cases, develop new sections to complete an emergency preparedness plan that addressed the risks identified in their risk assessment and the specific requirements contained in this section. The plan will also address how the dialysis facility will continue providing its essential services, which are the services that the dialysis facility will continue to provide despite an emergency. The dialysis facility will also need to review, revise, and, in some cases, develop delegations of authority or succession plans that the dialysis facility determined were necessary for the appropriate initiation and management of their emergency preparedness plan.

The burden associated with this requirement will be the time and effort necessary to develop the emergency preparedness plan. Based upon our experience with dialysis facilities, we expect that developing the emergency preparedness plan will require the involvement of the dialysis facility's chief executive officer or administrator, medical director, nurse manager, social worker, and a PCT. We believe that all of these individuals will probably have to attend an initial meeting, review relevant sections of the facility's current emergency preparedness or disaster plan(s), develop comments and recommendations for changes to the assessment, attend a follow-up meeting, and then perform a final review and approve the risk assessment. We believe that the administrator will probably coordinate the meetings, do an initial review of the current risk assessment, provide a critique of the risk assessment, offer suggested revisions, coordinate comments, develop the new risk assessment, and assure that the necessary parties approved the new risk assessment. We also believe that the administrator, medical director, and nurse manager will probably spend more time reviewing and working on the risk assessment than the other individuals involved in developing the plan. The social worker and PCT will likely just review the plan or relevant sections of it. In addition, since the medical director's responsibilities include participation in the development of patient care policies and procedures (42 CFR 494.150(c)), we expect that the medical director will be involved in the development of the emergency preparedness plan. This is less time than we estimate it will take for the risk assessment because dialysis facilities are currently required to have an emergency plan (§ 494.60(d)(4)). Based on this final rule, the dialysis facility will need to update, revise, and, in some cases, develop new sections to complete an emergency preparedness plan that addresses the risks identified in their risk assessment and the specific requirements contained in this regulation.

We estimate that complying with this requirement will require 10 burden hours at a cost of $1,116 for each dialysis facility. There are 6,648 dialysis facilities. Therefore, it will require an estimated 66,480 burden hours (10 burden hours for each dialysis facility × 6,648 dialysis facilities) to complete the plan at a cost of $7,419,168 ($1,116 estimated cost for each dialysis facility × 6,648 dialysis facilities).

Each dialysis facility will also be required to review and update its emergency preparedness plan at least annually. We believe that dialysis facilities already review their emergency preparedness plans periodically. The current CfCs already requires dialysis facilities to evaluate the effectiveness of their emergency and disaster plans and update them as necessary (42 CFR 494.60(d)(4)(ii)). Thus, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 494.62(b) will require dialysis facilities to develop and implement emergency preparedness policies and procedures based on the emergency plan, the risk assessment, and communication plan as set forth in § 494.62(a), (a)(1), and (c), respectively. These emergencies will include, but will not be limited to, fire, equipment or power failures, care-related emergencies, water supply interruptions, and natural and man-made disasters that are likely to occur in the facility's geographical area. Dialysis facilities will also have to review and update these policies and procedures at least annually. The policies and procedures will be required to address, at a minimum, the requirements listed at § 494.62(b)(1) through (9).

We expect that all dialysis facilities have some emergency preparedness policies and procedures. The current CfCs at § 494.60(d) already require dialysis facilities to implement processes and procedures to manage medical and nonmedical emergencies that include, but not limited to, fire, equipment or power failures, care-related emergencies, water supply interruption, and natural disasters likely to occur in the facility's geographic area. In addition, we expect that dialysis facilities already have procedures that will satisfy some of the requirements in this section. For example, each dialysis facility is already required at § 494.60(d)(4)(iii) to contact its local disaster management agency at least annually to ensure that such agency is aware of dialysis facility needs in the event of an emergency. However, all dialysis facilities will need to review their policies and procedures, assess whether their policies and procedures incorporated all of the necessary elements of their emergency preparedness program, and then, if necessary, take the appropriate steps to ensure that their policies and procedures encompassed these requirements.

The burden associated with the development of these emergency policies and procedures will be the time and effort necessary to comply with these requirements. We expect the administrator, medical director, and the nurse manager will be primarily involved with reviewing, revising, and if needed, developing any new policies and procedures that were needed. The remaining individuals will likely review the sections of the policies and procedures that directly affect their areas of expertise. Therefore, we estimate that complying with this requirement will require 10 burden hours at a cost of $1,116 for each dialysis facility. There are 6,648 dialysis facilities. Therefore, it will require an estimated 66,480 burden hours (10 burden hours for each dialysis facility × 6,648 dialysis facilities) to complete the plan at a cost of $7,419,168 ($1,116 estimated cost for each dialysis facility × 6,648 dialysis facilities).

The dialysis facility must also review and update its emergency preparedness policies and procedures at least annually. We believe that dialysis facilities already review their emergency preparedness policies and procedures periodically. In addition, the current CfCs already require (at 42 CFR 494.150(c)(1)) the medical director to participate in a periodic review of patient care policies and procedures. Thus, we believe compliance with this requirement will constitute a usual and customary business practice for dialysis facilities and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 494.62(c) will require dialysis facilities to develop and maintain an emergency preparedness communication plan that complied with both federal and state law. The dialysis facility must also review and update this plan at least annually. The communication plan must include the information listed at § 494.62(c)(1) through (7).

We expect that all dialysis facilities have some type of emergency preparedness communication plan. A communication plan will be an integral part of any emergency preparedness plan. Current CfCs already require dialysis facilities to have a written disaster plan (42 CFR 494.60(d)(4)). Thus, each dialysis facility should already have some of the contact information they will need to have in order to comply with this section. In addition, we expect that it is standard practice in the healthcare industry to have and maintain contact information for both staff and outside sources of assistance; alternate means of communications in case there is an interruption in phone service to the facility, such as cell phones or text-messaging devices; and a method for sharing information and medical documentation with other healthcare providers to ensure continuity of care for their patients. However, many dialysis facilities may not have formal, written emergency preparedness communication plans. Therefore, we expect that all dialysis facilities will need to review, update, and in some cases, develop new sections for their plans to ensure that those plans included all of the previously-described required elements in their emergency preparedness communication plan.

The burden associated with complying with this requirement will be the resources required to review and revise the dialysis facility's emergency preparedness communication plan to ensure that it complied with these requirements. Based upon our experience with dialysis facilities, we anticipate that satisfying these requirements will primarily require the involvement of the dialysis facility's administrator, medical director, and nurse manager. For each dialysis facility, we estimate that complying with this requirement will require 4 burden hours at a cost of $513. Therefore, for all of the dialysis facilities to comply with this requirement will require an estimated 26,592 burden hours (4 burden hours for each dialysis facility × 6,648 dialysis facilities) at a cost of $3,410,424 ($513 estimated cost for each dialysis facility × 6,648 dialysis facilities).

Each dialysis facility will also have to review and update its emergency preparedness communication plan at least annually. For the purpose of determining the burden for this requirement, we will expect that dialysis facilities will review their emergency preparedness communication plans annually. We believe that all dialysis facilities have an administrator that will be primarily responsible for the day-to-day operation of the dialysis facility. This will include ensuring that all of the dialysis facility's policies, procedures, and plans were up-to-date and complied with the relevant federal, state, and local laws, regulations, and ordinances. We expect that the administrator will be responsible for periodically reviewing the dialysis facility's plans, policies, and procedures as part of his or her work responsibilities. Therefore, we expect that complying with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 494.62(d) will require dialysis facilities to develop and maintain emergency preparedness training, testing and patient orientation programs that will have to be evaluated and updated at least annually. The dialysis facility will have to comply with the requirements located at § 494.62(d)(1) through (3).

Section 494.62(d)(1) will require that dialysis facilities provide initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles, and maintain documentation of the training. Thereafter, the dialysis facility will have to provide emergency preparedness training at least annually.

Current CfCs already require dialysis facilities to provide training and orientation in emergency preparedness to the staff (§ 494.60(d)(1)) and provide appropriate orientation and training to patients in emergency preparedness (§ 494.60(d)(2)). In addition, the dialysis facility's patient instruction will have to include the same matters that are specified in the current CfCs (42 CFR 494.60(d)(2)). Thus, dialysis facilities should already have an emergency preparedness training program for new employees, as well as ongoing training for all their staff and patients. However, all dialysis facilities will need to review their current training programs and compare their contents to their updated emergency preparedness programs, that is, the risk assessment, emergency preparedness plan, policies and procedures, and communications plans that they developed in accordance with § 494.62(a) through (c). Dialysis facilities will then need to review, revise, and in some cases, develop new material for their training programs so that they complied with these requirements.

The burden associated with complying with this requirement will be the time and effort necessary to develop the required training program. We expect that complying with this requirement will require the involvement of the administrator, medical director, and the nurse manager. In fact, the medical director's responsibilities include, among other things, staff education and training (§ 494.150(b)). We estimate that it will require 7 burden hours for each dialysis facility to develop an emergency training program at a cost of $807. Therefore, it will require an estimated 46,536 burden hours (7 burden hours for each dialysis facility × 6,648 dialysis facilities) to comply with this requirement at a cost of $5,364,936 ($807 estimated cost for each dialysis facility × 6,648 dialysis facilities).

The dialysis facility must also review and update its emergency preparedness training program at least annually. We believe that dialysis facilities already review their emergency preparedness training programs periodically. Therefore, we believe compliance with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 494.62(d)(2) requires dialysis facilities to participate in a full scale exercise at least annually. They will also be required to conduct one additional exercise of their choice at least annually. If the dialysis facility experienced an actual natural or man-made emergency that required activation of their emergency plan, the dialysis facility will be exempt from engaging in a full-scale exercise for 1 year following the onset of the actual event. Dialysis facilities will also be required to analyze their responses to and maintain document of all drills, tabletop exercises, and emergency events. To comply with this requirement, a dialysis facility will need to develop scenarios for each drill and exercise. A dialysis facility will also have to develop the documentation necessary for recording and analyzing the drills, tabletop exercises, and emergency events.

The current CfCs already require dialysis facilities to evaluate their emergency preparedness plan at least annually (42 CFR 494.60(d)(4)(ii)). Thus, we expect that all dialysis facilities are already conducting some type of tests to evaluate their emergency plans. Although the current CfCs do not specify the type of drill or test, dialysis facilities should have already been developing scenarios for testing their plans. Thus, we believe complying with this requirement will constitute a usual and customary business practice and will not be subject to the PRA in accordance with the implementing regulations of the PRA at 5 CFR 1320.3(b)(2).

Section 494.62(d)(3) will require dialysis facilities to provide appropriate orientation and training to patients, including the areas specified in § 494.62(d)(1). Section 494.62(d)(1) specifically will require that staff demonstrate knowledge of emergency procedures including the emergency information they must give to their patients. Thus, the burden associated with this section will already be included in the burden estimate for § 494.62(d)(1).

T. Summary of Information Collection Burden

Based on the previous analysis, the burden for complying with all of the requirements in this final rule will be 3,089,505 burden hours at a cost of $279,680,069. Table 127 provides a summary of the ICR burden, for the hours and the costs, for each element of the requirements in this final rule for each provider and supplier type.

If you comment on these information collection and recordkeeping requirements, please mail copies directly to the following: Centers for Medicare & Medicaid Services, Office of Strategic Operations and Regulatory Affairs, Regulations Development Group, Attn.: William Parham, (CMS-3178-F), Room C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850; and Office of Information and Regulatory Affairs, Office of Management and Budget, Room 10235, New Executive Office Building, Washington, DC 20503, Attn: CMS Desk Officer, CMS-3178-F, Fax (202) 395-6974.

IV. Regulatory Impact Analysis

A. Statement of Need

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity).

In response to past terrorist attacks, natural disasters, and the subsequent national need to refine the nation's strategy to handle emergency situations, there continues to be a coordinated effort across federal agencies to establish a foundation for development and expansion of emergency preparedness systems. There are two Presidential Directives, HSPD-5 and HSPD-21, instructing agencies to coordinate their emergency preparedness activities with each other. Although these directives do not specifically require Medicare providers and suppliers to adopt measures, they have set the stage for what we expect from our providers and suppliers in regard to their roles in a more unified emergency preparedness system.

Homeland Security Presidential Directive (HSPD-5): Management of Domestic Incidents requires the Department of Homeland Security to develop and administer the National Incident Management System (NIMS).

Homeland Security Presidential Directive (HSPD-21) addresses public health and medical preparedness. The directive establishes a National Strategy for Public Health and Medical Preparedness (Strategy), which builds upon principles set forth in “Biodefense for the 21st Century” (April 2004), “National Strategy for Homeland Security” (October 2007), and the “National Strategy to Combat Weapons of Mass Destruction” (December 2002). The directive aims to transform our national approach to protecting the health of the American people against all disasters.

B. Overall Impact

We have examined the impacts of this final rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995 Pub. L. 104-4), and Executive—Order 13132 on Federalism (August 4, 1999), and the Congressional Review Act (5 U.S.C. 804(2)).

Executive Orders 12866 and 13563 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more annually). The total projected cost of this rule will be $373 million in the first year, and the subsequent projected annual cost will be approximately $25 million. We solicited and received comments on the proposed RIA. As such, we have presented our best estimate of the impact, including both costs and benefits, of this rule.

1. Disaster Data

Published reports after Hurricane Katrina reported that the Louisiana Attorney General investigated approximately 215 deaths that occurred in hospitals and nursing homes following Katrina. (Fink, Sheri (September 10, 2013). Five Days at Memorial: Life and Death in a Storm-Ravaged Hospital. New York: Crown Publishers. p. 360. ISBN 978-0-307-71896-9.) Since nearly all hospitals and nursing homes are certified to participate in the Medicare program, we estimate that at least a small percentage of these lives could be saved as a result of emergency preparedness measures in a single disaster of equal magnitude. Katrina is an extreme example of a natural disaster, so we also considered other more common disasters. The United States experiences numerous natural disasters annually, including, in particular, tornadoes and flooding. Based on data from the National Oceanic and Atmospheric Administration, the United States experiences an annual average of 56 fatalities as a result of tornadoes ( http://www.spc.noaa.gov/wcm/ustormaps/1981-2010-stateavgfatals.png ). On average, floods kill about 140 people each year (United States Department of the Interior, United States Geological Survey Fact Sheet “Flood Hazards—A National Threat” January, 2006, at http://pubs.usgs.gov/fs/2006/3026/2006-3026.pdf ).

2. Benefits to Patients/Residents

It is commonly understood that healthcare facilities that do not have an emergency plan, develop policies and procedures, and train and exercise their staff are at a heightened risk for healthcare delivery and service disruptions. For instance, patients with ESRD have experienced problems accessing care and adverse outcomes during disasters. These patients are particularly at risk for having increased morbidity and mortality following disasters due to their dependence on regular life-maintaining dialysis treatments. Hurricane Katrina was particularly devastating for the dialysis-dependent population and led to the dialysis community, including facilities, recommending more integrated and better emergency planning, training and exercises in addition to other preparedness recommendations. One example was for dialysis facilities to implement early dialysis (an early treatment in advance of the storm's landfall) for notice weather events, such as hurricanes, snow storms, or other severe weather (Kenney, Robert J. “Emergency preparedness concepts for dialysis facilities: Reawakened after Hurricane Katrina.” Clinical Journal of the American Society of Nephrology 2.4 (2007): 809-813 DOI: 10.2215/CJN.03971106). In order to implement early dialysis, particularly in moderate to large scale emergencies, facilities need to have an integrated emergency plan, policies and procedures, training and exercises. All of which are needed to better ensure that staff are able to rapidly activate and operate the facility emergency plan, prioritize and contact patients and transportation, and coordinate a surge in patient care coordination for both early and their regularly scheduled dialysis treatments.

Hurricane Sandy was predicted to be a severe storm many days in advance of its actual landfall. State health officials, in anticipation of its severity, encouraged dialysis facilities to dialyze patients ahead of schedule and rapidly activated the Kidney Community Emergency Response (KCER) Coalition to provide additional assistance for coordinating notification and transportation services for patients, and to activate additional staff and resources to provide treatment at numerous facilities. Studies, following Hurricane Sandy, found regional variability in the receipt of early dialysis amongst the nearly 14,000 dialysis study patients. ASPR and CMS, using Medicare claims data, conducted the two studies to assess the impact of Hurricane Sandy on end-stage renal disease patients that require regular dialysis and to assess early dialysis treatment patterns and outcomes for those receiving it in the impacted areas. The first study identified a significant increase in the number of emergency department visits, hospitalizations, and patient death 30 days following the disaster and regional variability in patients receiving early dialysis prior to Hurricane Sandy's landfall. The second study found that the 60 percent of study patients that received early dialysis were found to have 20 percent lower odds of having an emergency department visit, 21 percent lower odds of a hospitalization in the week of the storm, and 28 percent lower odds of death 30 days after the storm. (Kelman J., Finne K., Bogdanov A., Worrall C., Margolis G., Rising K., MaCurdy T.E., Lurie N. Dialysis care and death following Hurricane Sandy. Am J Kidney Dis. 2015 Jan; 65(1):109-15. doi: 10.1053/j.ajkd.2014.07.005. Epub 2014 Aug 22. PubMed PMID: 25156306. and Lurie, N., Finne, K., Worrall, C., Jauregui, M., Thaweethai, T., Margolis, G., & Kelman, J. (2015). Early dialysis and adverse outcomes after Hurricane Sandy. Am J Kidney Dis., 66(3), 507-512.

Although we are unable to specifically quantify the number of lives saved as a result of this final rule, all of the data we have reviewed regarding emergency preparedness indicate that implementing the requirements in this final rule could have a significant impact on protecting the health and safety of individuals served by providers and suppliers that participate in the Medicare and Medicaid programs. The following cost analysis is based on “Guidelines for Regulatory Impact Analysis” (Robinson, L.A. and J.K. Hammitt. 2015, “Valuing Reductions in Risks of Fatal Illness: Implications of Recent Research.” Health Economics. 25(8): 1039-1052) developed by Harvard University for the Assistant Secretary for Planning and Evaluation (ASPE). The Guidelines are not yet public, however based on the research that was published in Health Economics, we have provided the following cost analysis. In order to “break even” on the cost of this rule, that is, in order for the total costs of implementing this rule to equal the total benefits of doing so- this rule would need to save 11.5 lives per year for 5 years at a 7 percent discount rate and a value of $9 million per statistical life saved. It would take about 11 statistical lives saved per year for 5 years at a 3 percent discount rate for this final rule to break even. Therefore, we believe it is crucial for all providers and suppliers to have an emergency disaster plan that is integrated with other local, state and federal agencies to effectively address both natural and manmade disasters.

We believe that this final rule will be an economically significant regulatory action under section 3(f)(1) of Executive Order 12866, since it may lead to impacts of greater than $100 million in the first year following the rule's effective date.

This final rule will establish a regulatory framework with which Medicare- and Medicaid-participating providers and suppliers will have to comply to ensure that the varied providers and suppliers of healthcare are adequately prepared to respond to natural and man-made disasters.

3. The Regulatory Flexibility Act (RFA)

The Regulatory Flexibility Act (RFA) (5 U.S.C. 601 et seq.) (RFA) requires agencies that issue a regulation to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. The Act defines a “small entity” as: (1) A proprietary firm meeting the size standards of the Small Business Administration (SBA); (2) a not-for-profit organization that is not dominant in its field; or (3) a small government jurisdiction with a population of less than 50,000. States and individuals are not included in the definition of “small entity.”) HHS uses as its measure of significant economic impact on a substantial number of small entities a change in revenues of more than 3 to 5 percent.

The RFA requires agencies to analyze options for regulatory relief of small entities, if a rule has a significant impact on a substantial number of small entities. For purposes of the RFA, we estimate that most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of less than $11 million to $38.5 million in any 1 year. For purposes of the RFA, a majority of hospitals are considered small entities due to their non-profit status. Individuals and states are not included in the definition of a small entity. Since the cost associated with this final rule is less than $46,000 for hospitals and $4,000 for other entities, the Secretary has determined that this proposed will not have a significant economic impact on a substantial number of small entities.”

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a metropolitan statistical area and has fewer than 100 beds. Since the cost associated with this final rule is less than $46,000 for hospitals, this this proposed will not have a significant impact on the operations of a substantial number of small rural hospitals.

4. Unfunded Mandates Reform Act

Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) requires that agencies assess anticipated costs and benefits before issuing any rule that includes a federal mandate that could result in expenditure in any 1 year by state, local or tribal governments, in the aggregate, or by the private sector, of $100 million in 1995 dollars, updated annually for inflation. In 2016, that threshold level is approximately $146 million. This omnibus final rule contains mandates that will impose a one-time cost of approximately $373 million. Thus, we have assessed the various costs and benefits of this final rule. It is clear that a number of providers and suppliers will be affected by the implementation of this final rule and that a substantial number of those entities will be required to make changes in their operations. This final rule will not mandate any new requirements for state, local or tribal governments. For the private sector facilities, this regulatory impact section constitutes the analysis required under UMRA.

5. Federalism

Executive Order 13132 establishes certain requirements that an agency must meet when it develops a final rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. This final rule will not impose substantial direct requirement costs on state or local governments, preempt state law, or otherwise implicate federalism.

6. Congressional Review Act

This final rule is subject to the Congressional Review Act provisions of the Small Business Regulatory Enforcement Fairness Act of 1996 (5 U.S.C. 801 et seq.) and has been transmitted to the Congress and the Comptroller General for review.

C. Anticipated Effects on Providers and Suppliers: General Provisions

This final rule will require each of the Medicare- and Medicaid-participating providers and suppliers discussed in previous sections to perform a risk analysis; establish an emergency preparedness plan, emergency preparedness policies and procedures, and an emergency preparedness communication plan; train staff in emergency preparedness, and test the emergency plan. The economic impact will differ between hospitals and the various other providers and suppliers, depending upon a variety of factors, including existing regulatory requirements and accreditation standards.

We discuss the economic impact for each provider and supplier type included in this final rule in the order in which they appear in the CFR. Most of the economic impact of this final rule will be due to the cost for providers and suppliers to comply with the information collection requirements. Thus, we discuss most of the economic impact under the Collection of Information Requirements section of this final rule. We provide a chart at the end of the RIA section of the total regulatory impact for each provider or supplier.

As stated in the ICR section of this final rule, we obtained all salary information from the May 2014 National Occupational Employment and Wage Estimates, United States by the Bureau of Labor Statistics (BLS) at http://www.bls.gov/oes/current/oes_nat.htm and calculated the added value of 100 percent for overhead and fringe benefits.

1. Subsistence Requirement

This final rule will require all inpatient providers to meet the subsistence needs of staff and patients, whether they evacuate or shelter in place, including, but not limited to, food, water, and supplies, alternate sources of energy to maintain temperatures to protect patient health and safety and for the safe and sanitary storage of such provisions.

Based on our experience, we expect inpatient providers to currently have food, water, and supplies, alternate sources of energy to provide electrical power, and the maintenance of temperatures for the safe and sanitary storage of such provisions as a routine measure to ensure against weather related and non-disaster power failures. Thus, we believe that this requirement is a usual and customary business practice for inpatient providers and we have not assigned any impact for this requirement.

Furthermore, we expect that most providers have agreements with their vendors to receive supplies within 24 to 48 hours in the event of an emergency, as well as arrangements with back-up vendors in the event that the disaster affects the primary vendor. We considered proposing a requirement that providers must keep a larger quantity of food and water on hand in the event of a disaster. However, we believe that a provider should have the flexibility to determine what is adequate based on the location and individual characteristics of the facility. While some providers may have the storage capacity to stockpile supplies that will last for a longer duration, other may not. Thus, we believe that to require such stockpiling will create an unnecessary economic impact on some healthcare providers.

We expect that when inpatient providers determine their supply needs, they will consider the possibility that volunteers, visitors, and individuals from the community may arrive at the facility to offer assistance or seek shelter.

Based on the previous factors, we have not estimated a cost for a stockpile of food and water.

2. Generator Location and Testing

We proposed to require hospitals, CAHs, and LTC facilities to test and maintain their emergency and standby power systems in such a way to ensure proper operation in the event they are needed. The 2012 edition of the Life Safety Code (LSC) of the NFPA® states that the alternate source of power (for example, generator) must be located in an appropriate area to minimize the possible damage resulting from disasters such as storms, floods, earthquakes, tornadoes, hurricanes, vandalism, sabotage and other material and equipment failures. Since hospitals, CAHs and LTC facilities are currently required to comply with the referenced LSC; we have not assigned any additional burden for this requirement.

In addition to the emergency power system inspection and testing requirements found in NFPA® 99 and NFPA® 110 and NFPA® 101, we proposed that hospitals test their emergency and stand-by-power systems for a minimum of 4 continuous hours every 12 months at 100 percent of the power load the hospital anticipates it will require during an emergency. We received the following public comment(s) on this requirement:

Comment: We received a large number of comments from individual hospitals as well as national and state organizations that expressed concern with the proposed requirement for hospitals, CAHs and LTC facilities to test their generators. Several commenters stated that there was not enough empirical data to support the proposed additional financial burden. Furthermore, they stated that there is no evidence that additional annual testing would result in more reliable generators and that their current testing schedule is sufficient. Several commenters stated that mandating additional testing would further burden already strained budgets and that the additional testing would cause unnecessary wear and tear on the equipment.

Response: We appreciate the commenters concerns on this issue. As we discussed previously in the preamble of this final rule, the purpose of the proposed change in the testing requirement was to minimize the issue of inoperative equipment in the event of a major disaster, such as what happened during the Sandy Super Storm. After carefully reviewing subsequent reports on the Sandy Super Storm (for example, the September, 2014 report of the Office of Inspector General (OIG) entitled, “Hospital Emergency Preparedness and Response During Super Storm Sandy; and the American Society for Healthcare Engineering (ASHE)), and the comments received on the proposed requirement, we believe that we do not have sufficient data to make the assumption that additional testing would ensure that the generators would withstand all disasters, regardless of the amount of testing conducted prior to an actual disaster. Therefore, we have decided against finalizing the proposed requirement for additional generator testing at this time. We expect facilities that have generators to continue to test their equipment based on current NFPA® codes (NFPA® 99 and NFPA® 110 and NFPA® 101) and manufacturer requirements.

3. Purchase of Communication Devices

We are finalizing our proposal to require providers and suppliers to develop and maintain a communication plan that includes the contact information for and a means for communicating with staff, federal, state, tribal, regional, and local emergency management entities. It is crucial for providers and suppliers to be aware of who to contact during an emergency situation and for them to have a means for communicating with the appropriate emergency management officials during an emergency or disaster. While we did not propose a specific mechanism for purposes of communicating during an emergency, we recognize the possibility that some providers and suppliers may need to purchase communication devices to meet the requirements of this final rule.

We anticipate that most providers and suppliers maintain updated information for staff as well as state and local officials as part of their typical business operations. We also expect that as a best practice, many providers and suppliers already utilize some type of communication system or device for purposes of communicating with their staff, physicians, volunteers, and other providers and suppliers during emergency situations. We want to reiterate that in addition to cellular phones, alternate communication devices may also include but are not limited to pagers, radio transceivers, various radio devices such as the National Oceanic and Atmospheric Administration's Weather Radio All Hazards, and Portable interconnected Voice over Internet Protocol (VoIP) services.

For purposes of the RIA, we assume that, at a minimum, those providers and suppliers without existing emergency preparedness requirements are mostly likely to be presented with the need to purchase communication devices to comply with the requirements of the communication plan in this final rule. Those provider and supplier types without any existing emergency preparedness requirements are CMHCs, OPOs, PRTFs, and outpatient hospices. As stated previously, this final rule will impact 17 different provider and supplier types. When taking into consideration all 17 provider and supplier types, this rule will have a combined impact on 72,315 entities (sum of the total number of provider and supplier entities). Those providers and supplier types without emergency preparedness requirements represent 6 percent of this total (4,622 total entities without existing emergency preparedness related requirements (198 CMHCs + 58 OPOs + 377 PRTFs + 3,989 outpatient hospices)/72,315 (sum of the total number of entities impacted by this regulation)). Therefore, we anticipate that, at a minimum 6 percent of the providers and suppliers impacted by this final rule will have the potential need to purchase communication devices to comply with the requirements of the final rule.

4. Use of Outside Consultants

We recognize that some of the provider and supplier types impacted by this final rule have more experience in the area of emergency preparedness than others. In particular, those provider and supplier types without existing emergency preparedness related requirements may find it useful to seek resources and guidance from outside consultants for purposes of complying with the requirements of this final rule. We note that we have not required providers and suppliers to hire outside consultants to develop their emergency preparedness programs, and we do not believe it will be necessary in most cases based on the free resources and information available to providers. Furthermore, in advance of hiring outside consultants, we encourage providers and suppliers to look to their local public health, emergency management agencies and local healthcare coalitions for assistance and guidance. Therefore, for purposes of the RIA we have not included a cost associated with the activity of hiring outside consultants, as we are unable to quantify with any degree of certainty the number of providers that may choose to use outside resources or the cost of such resources.

There are nearly 500 healthcare coalitions nationwide that providers and suppliers may seek to participate in, which currently include more than 24,000 healthcare facilities and community partners. In addition, providers and suppliers should leverage resources through their memberships with professional associations and non-government agencies, such as the Red Cross. Many non-government organizations and both national and local professional associations provide vetted emergency preparedness resources, materials and trainings. These organizations and healthcare coalitions also commonly conduct and support community-based exercises and encourage participation from other providers in their localities.

In addition, we note that there are several readily accessible, free, and expert-vetted, emergency preparedness resources that are available to providers and suppliers from government entities. First, providers and suppliers may access HHS' Office of the Assistant Secretary for Preparedness and Response (ASPR) Technical Resources Assistance Center Information Exchange (TRACIE) found at https://asprtracie.hhs.gov/ . TRACIE can be used to locate sample plans, tools, templates, and training and exercise materials. TRACIE also provides access to expert technical assistance and an information-sharing exchange platform to assist the exchange of best practices, vetted tools, and information between public health, healthcare professionals, and many other emergency preparedness partners. TRACIE's technical assistance specialists can be reached Monday through Friday, 9 a.m. to 5 p.m. Eastern Standard Time, at 1-844-5-TRACIE or by email at askasprtracie@hhs.gov.

Providers and suppliers may also access the Centers for Disease Control and Prevention (CDC) Web site found at http://www.cdc.gov/phpr/healthcare/planning.html ) for various tools and resources. In addition, there are many tools and free online training sessions related to emergency preparedness that are offered through FEMA's Emergency Management Institute (EMI) Web site found at https://training.fema.gov/emi.aspx .