Home health · CMS survey prep

The Complete Home Health Emergency Preparedness Plan: What CMS Actually Requires

By Dr. Arzoo Salami, physician & founder, SurgeReady · September 3, 2026 · 8 min read

Photo by Pavel Danilyuk · Pexels

If you run a home health agency, you already know the drill: CMS requires you to have an emergency preparedness program. It's not optional. It's a condition of participating in Medicare.

But here's what trips most agencies up — they don't know exactly what the surveyor is looking for when they walk in. They've got a binder somewhere, maybe inherited from the last administrator, and they're hoping it's enough.

Usually, it isn't.

This post breaks down every requirement under 42 CFR §484.102 (the emergency preparedness section of the Home Health Conditions of Participation) in plain English. No consultant-speak. No fluff. Just what you need to have ready before your next survey.

Why This Matters Right Now

Emergency preparedness consistently appears in the top 20 deficiency areas cited in home health surveys. The citations usually aren't because an agency didn't care about preparedness — they're because the documentation didn't match what the surveyor expected to see.

The CMS Emergency Preparedness Rule, finalized in 2016 and enforced since 2017, applies to 17 provider and supplier types. Home health agencies are one of them. The detailed interpretive guidelines live in Appendix Z of the State Operations Manual — that's the document surveyors carry with them.

The rule is built around four elements. You need all four. Here's what's inside each one.

The Emergency Plan

Your plan needs to start with a risk assessment — a documented look at what emergencies could realistically affect your agency and your patients. CMS calls this a "facility-based and community-based risk assessment using an all-hazards approach." In practice, that means you sit down and think through what natural disasters hit your area (hurricanes, tornadoes, flooding, wildfires, ice storms), what man-made threats are realistic (power grid failures, chemical spills, active violence), what facility-based problems could happen (IT system outages, loss of key staff, office flooding), and what infectious disease scenarios you'd need to handle, including pandemics.

Write it down. This is your All-Hazards Risk Assessment, and it's the foundation everything else is built on.

From that risk assessment, your plan must include specific strategies for each identified emergency — not general statements, but actual descriptions of what your agency will do if a hurricane hits or if there's a prolonged power outage. It needs to address your patient population directly. Home health patients are uniquely vulnerable: they're in their own homes, often with mobility limitations, medical equipment that needs electricity, and limited ability to self-evacuate. Your plan has to account for all of that. It also needs a clear chain of command with delegations of authority and succession plans — who's in charge if the administrator can't be reached — and documented coordination with local emergency management, the health department, and state and federal agencies.

Policies and Procedures

This is where the rubber meets the road. Your policies and procedures must be based on your plan, your risk assessment, and your communication plan, and they need to cover several specific areas that CMS spells out. They're reviewed and updated on the same two-year cycle as the plan itself.

Individual Patient Emergency Plans

Every patient in your care must have an individual emergency plan as part of their comprehensive assessment. This isn't a suggestion — it's a regulatory requirement under E-0017. You need to document what disasters could affect this specific patient in their specific home, what the plan is for that patient if an emergency hits, that you've discussed it with the patient or caregiver, and that a copy lives in both the patient's file and the patient's hands.

Evacuation and Follow-Up

Your agency must have procedures to notify state and local emergency officials about patients who need help evacuating. This means sharing, in a HIPAA-compliant way, each patient's mobility status, life-sustaining equipment needs, special medical or psychiatric needs, and communicable disease status. Pre-coordinate this with your local emergency management office before a disaster happens. Don't wait until a hurricane is bearing down to figure out who to call.

When an emergency interrupts your normal operations, you need procedures for checking in on all on-duty staff and all patients to determine their service needs, notifying state and local officials about any staff or patients you can't reach, and arranging transfers to hospitals or nursing facilities when patients need a higher level of care.

Medical Records and Staffing

You need a system that preserves patient information, protects confidentiality, and keeps records accessible during an emergency. Think about what happens if your office floods or your EHR goes down — do you have backup access? Your staffing policies also need to address how you'll use volunteers, how you'll contact off-duty staff, what happens when staff can't report to work, and how you'd integrate state or federally designated healthcare professionals during a surge event.

The Communication Plan

This is the piece surveyors probe hardest, because it's the piece that fails first in a real event. Your communication plan must comply with federal, state, and local laws, and it's reviewed and updated on the same two-year cycle.

You need current contact information for all staff members, entities providing services under arrangement, each patient's physician or practitioner, and volunteers — with a backup copy, either electronic or hard copy, that works when your computer system goes down. You also need contact information for federal, state, tribal, regional, and local emergency preparedness officials, your State Survey Agency, local and state public health departments, and other sources of emergency assistance.

For communication methods, you need both a primary and an alternate way to reach your staff and emergency management agencies. Think cell phones, landlines, two-way radios, satellite phones, group text platforms. Make sure your backup method actually works when the primary goes down — cell towers often overload during disasters.

You also need a method for sharing patient information with other healthcare providers to maintain continuity of care: patient name, age, date of birth, allergies, current medications, diagnoses, blood type, advance directives, and emergency contacts, all shared in a HIPAA-compliant way under 45 CFR 164.510. And you need a way to report your agency's needs and capabilities to the local incident command — can you still serve patients, do you need resources — so that information flows in both directions.

If it isn't written down — with dates, participants, and what you'd change next time — it doesn't count on survey day.

Training and Testing

Every person who works for your agency — employees, contractors, volunteers — must receive emergency preparedness training when they start, with refreshers at least every two years. You need additional training when policies or procedures are significantly updated. And you must be able to demonstrate that staff know what to do: sign-in sheets, training content records, competency verification. A surveyor will ask to see these records.

Your agency must also conduct exercises to test the plan. The schedule works like this: at least one exercise every year, and every two years one of those exercises must be either a full-scale community-based exercise or a facility-based functional exercise. In the alternate year, your exercise can be a full-scale exercise, a functional exercise, a mock disaster drill, or a tabletop exercise. If your agency activates its emergency plan during an actual emergency, that counts for the cycle — but you still need to document what happened and what you learned.

The key requirement most agencies miss: after every exercise, you must analyze your response, document the results, and revise your emergency plan based on what you learned. This is your After-Action Report/Improvement Plan (AAR/IP). Surveyors specifically look for it, and its absence is one of the most common citations.

The Most Common Mistakes

Based on CMS survey data and frequently cited EP citations, the same handful of gaps show up again and again. The plan was written three years ago and nobody's touched it — the rule requires review and update every two years, and the surveyor will check the date. The risk assessment exists as a concept but not as a standalone document with dates and specifics. Individual patients don't have emergency plans in their care records, even though E-0017 requires one for every patient. The agency ran a drill but there's no sign-in sheet, no after-action report, no evidence the plan was updated based on lessons learned. Contact lists are outdated, there's no alternate communication method documented, or the plan for sharing patient information with other providers was never written down.

None of these are complicated to fix. They're easy to let slide when preparedness is one more item on a long list and nobody owns it full time — which describes most small agencies.

What to Do Next

If you're reading this because your survey is coming up, here's the honest truth: you can get your emergency preparedness documentation survey-ready in a weekend if you know exactly what's required. That's what the SurgeReady Home Health Ready-Kit was built for — every template, mapped to the E-tags the surveyor checks, organized in a binder structure you can hand to them.

Here's a sample of what's inside:

The full kit includes 12 templates like this — risk assessment, emergency plan, all policies and procedures, communication plan, training logs, exercise scenarios, and the after-action report — all cross-referenced to the E-tags so nothing gets missed.

But whether you use our kit or build it yourself, the requirements above are what you need to cover. No shortcuts, no gaps.

Start with the risk assessment. Everything else flows from it.

This post is educational and does not constitute legal or compliance advice. Consult your compliance team or legal counsel for guidance specific to your facility.

Dr. Arzoo Salami is a physician and founder of SurgeReady, bringing the same emergency preparedness tools large hospital systems use to community-based healthcare organizations. Get in touch.