1. Community Health Centers of Arkansas CMS Requirements and How to meet Compliance August 10, 2017
Mark Fuller

2. Topics For Today Introductions
Overview of CMS Requirements and related rules
Detailed Analysis of Continuity Planning Elements of Viability
Best Practices and Lessons Learned

3. Your Sector, Expertise and Responsibility?
Introductions
Your Sector, Expertise and Responsibility?

4. Situational Awareness
What are the Rules and Regulations?
Have we already done things that apply?
What are our unmet needs for Compliance?
How do we meet the unmet needs?
What is our current engagement level with partners/potential partners?

5. Health Resources and Services Administration (HRSA) - HRSA PIN 2007-15
Key Elements of Emergency Plans and Procedures for Federally Qualified Health Care Centers
Health Resources and Services Administration (HRSA) - HRSA PIN
Centers for Medicaid Medicare Services (CMS) Rule # 81 FR No. 180 – Medicare and Medicaid Programs; Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers; Final Rule

6. Why are these two rules Important?
In addition to being regulations, these rules provide the basic foundations of viable and compliant Emergency response planning for health care organizations.

7. How do they tie together?
Both regulations have common objectives.
Many of these common objectives can be addressed via a coordinated planning approach in the following areas:
Emergency and continuity plans and procedures.
Test, training and exercise.
Communication, collaboration and coordination.
Hazard Vulnerability (site specific).

8. HRSA PIN
Health centers must have risk management policies and procedures in place that proactively and continually identify and plan for potential and actual risks to the health center in terms of its facilities, staff, clients/patients, financial, clinical, and organizational well-being. Plans and procedures for emergency management must be integrated into a health center’s risk management approach to assure that suitable guidelines are established and followed so that it can respond effectively and appropriately to an emergency. Health centers should also be aware that other entities (i.e., accrediting organizations, State and/or local health departments) may also have requirements related to emergency management activities. 

9. CMS Final Rule – September 16, 2016
This final rule establishes national emergency preparedness requirements for Medicare- and Medicaid-participating providers and suppliers to plan adequately for both natural and man-made disasters, and coordinate with federal, state, tribal, regional, and local emergency preparedness systems. Despite some variations, our regulations will provide consistent emergency preparedness requirements, enhance patient safety during emergencies for persons served by Medicare- and Medicaid-participating facilities, and establish a more coordinated and defined response to natural and man-made disasters.
Risk assessment
Emergency Operations Plan
Communications Plan
Training and exercising

10. Purpose of The New CMS Rule
To establish national emergency preparedness requirements to ensure adequate planning for both natural and man-made disasters, and coordination with federal, state, tribal, regional and local emergency preparedness systems.
Requirements will apply to all 17 provider and supplier types.
Each provider and supplier will have its own set of Emergency Preparedness regulations incorporated into its set of conditions or requirements for certification.
Must be in compliance with Emergency Preparedness regulations to participate in the Medicare or Medicaid program.
This Rule has teeth!

11. Goals of the CMS Rule Address systemic gaps. Establish consistency.
Encourage communication, coordination and collaboration.
The CMS Emergency Preparedness Rule was developed to address gaps identified in past responses, establish a consistent framework for all healthcare entities and to encourage coordination among healthcare entities, healthcare system preparedness entities, public health preparedness officials, and emergency managers.
The challenges for us in developing Conditions of Participation is really to develop requirements that will work for providers with varying characteristics and, while at the same time, striking a balance between patient safety and quality of care and consideration of the burden on providers. And we really tried to strike that balance in this rule.
we encourage participation in health care coalitions and want to emphasize the benefits of collaboration such as the use of mutual risk assessments; the development standardized tools, plans, and processes; and also shared training exercises and resource management.

12. Overview and Timeline of CMS Rule
Published in the Federal Register on December 27, 2013.
Increases patient safety during emergencies.
Establishes consistent emergency preparedness requirements across provider and supplier types.
Establishes a more coordinated response to natural and man-made disasters.
Applies to 17 Medicare and Medicaid providers and suppliers.
Final rule published in the Federal Register on September 16, 2016.
Regulation goes into effect November 16, 2016 with compliance mandated by November 16, 2017.
In September 2006, CMS kicked off a forum for discussing a variety of emergency preparedness issues. Stakeholders were invited to participate in the forum to discuss, communicate and disseminate emergency preparedness information. The stakeholders include a broad array of perspectives, and representatives include the following:
State Survey Agencies (SAs)
Accreditation organizations
Health care provider associations
Patient and resident advocates
Quality and safety organizations
Other Department of Health and Human Services (HHS) operating divisions

13. Conditions of Participation
Conditions of Participation (CoPs) and Conditions for Coverage (CfCs) are health and safety regulations which must be met by Medicare and Medicaid-participating providers and suppliers. They serve to protect all individuals receiving services from those organizations
The conditions, which we refer to as CoPs, are health and safety regulations which must be met by Medicare and Medicaid participating providers and suppliers. And they serve to protect all individuals receiving services from those organizations.
These regulations are conditions of participation for Medicare and Medicaid participating providers and suppliers, meaning that they must comply with the regulations and be in compliance at the time of survey in order to participate in Medicare and Medicaid reimbursement.
there are regulations regarding administration of various facilities, medical records, infection control, for example, quality assessment. So, emergency preparedness is just one of those sets of regulations.

14. Interpretive Guidelines
The Survey & Certification Group (SCG) is in the process of developing the Interpretive Guidelines (IGs) which will assist in implementation of the new regulation.
Initial Interpretive Guidelines were released on June 5, 2017.

15. Compliance
Compliance with the conditions is determined by survey, either by an accrediting organization or by a State survey agency.
Facilities are expected to be in compliance with these CoPs/CfC and requirements 1 year following the publication of the final rule.
In the event facilities are non-compliant, the same general process will occur as is currently in place for any other conditions and could lead to termination of the provider agreement.

16. What all of this Means
Development of comprehensive All-Hazards Emergency Operations Plans (EOPs) and Continuity of Operations (COOP) plans.
Ensuring that all plans are compliant and apply to all city, county, state and federal rules and regulations.
Communication, Collaboration and Coordination among regulatory /supporting agencies and potential stakeholders.
The HRSA PIN is a good starting point. Review what has been done and move forward to CMS requirements.

17. Four Provisions for All Provider Types
Risk Assessment and Planning
Polices and Procedures
Communication Plan
Test. Training and Exercise
This rule applies to 17 provider and supplier types as a condition of participation for CMS. The providers/suppliers are required to meet four core elements (with specific requirements adjusted based on the individual characteristics of each provider and supplier):
Emergency plan—Develop an emergency plan based on a risk assessment and using an “all-hazards” approach, which will provide an integrated system for emergency planning that focuses on capacities and capabilities.
Policies and procedures—Develop and implement policies and procedures based on the emergency plan and risk assessment that are reviewed and updated at least annually. For hospitals, Critical Access Hospitals (CAHs), and Long-Term Care (LTC) facilities, the policies and procedures must address the provision of subsistence needs, such as food, water and medical supplies, for staff and residents, whether they evacuate or shelter in place.
Communication plan—Develop and maintain an emergency preparedness communication plan that complies with federal, state and local laws.  Patient care must be coordinated within the facility, across healthcare providers, and with state and local public health departments and emergency management systems to protect patient health and safety in the event of a disaster.
A training and testing program—Develop and maintain training and testing programs, including initial training in policies and procedures. Facility staff will have to demonstrate knowledge of emergency procedures and provide training at least annually. Facilities must conduct drills and exercises to test the emergency plan or participate in an actual incident that tests the plan.
Each element of the plan must be reviewed and updated annually

18. Risk Assessment and Planning (HVAs)
Know your Hazards and Potential Threats.
Develop an emergency plan based on those hazards and threats.
Perform risk assessment using an “all-hazards” approach, focusing on capacities and capabilities.
Update emergency plan at least annually based on changing threats and hazards.
Providers must develop an emergency plan using an all-hazards approach, which would have them plan and identify in advance essential functions and who is responsible in a crisis.
Each provider is required to develop an emergency plan based on a risk assessment. The risk assessment must be documented and use an all-hazards approach. An all-hazards approach is an integrated approach that doesn’t specifically address every possible threat, but ensures providers have capacity to address a broad range of related emergencies. We would expect providers to consider business functions that should continue, risks that the provider is likely to confront, contingencies, the location of the provider, and also to determine whether arrangement with other providers is necessary to ensure continuity of care.
The regulations require each covered entity to develop an emergency operations plan based on a risk assessment. Risk assessments are conducted at the facility, jurisdictional and health care coalition levels and entities are encouraged to contact their local healthcare coalitions to participate in local risk assessments.
Once the risk assessment has been conducted, develop an emergency plan that addresses the entities ability to prepare for, respond to, and recover from emergencies and disasters and incorporates the specific regulations listed in the final rule.

19. Policies and Procedures
Develop and implement policies and procedures based on the emergency plan and risk assessment.
Many regulations are already standard safety practices already implemented by your facility.
Policies and procedures must address a range of issues including subsistence needs, evacuation plans, procedures for sheltering in place, tracking patients and staff during an emergency.
Consult Local Emergency Management and ESF 8 for Best Practices and Lessons Learned.
Review and update policies and procedures at least annually.
Each provider must develop and implement policies and procedures based on the emergency plan and the risk assessment.
The facilities must develop policies and procedures developed and based on the emergency preparedness plan that speak to issues such as medical documentation and evacuation or sheltering in place.

20. Areas to Consider – Policies and Procedures
Alternate energy sources (Generator and facilities ability to accept generator power).
Sewage, Medical /General Waste disposal.
Procedures for evacuating or sheltering in place.
Alert and Notification Procedures (staff, patients, emergency officials, media and vendors).
Medical documentation and back-up that ensures accessibility and confidentiality.
What are the trigger points that would activate COOP?
The policies must address the provision of subsistence needs, alternate energy sources, sewage and waste disposal, procedures for evacuating or sheltering in place. There must be a system to track the location of staff and patients. There must be safe evacuation considerations, such as care and treatment needs, transportation ID, and evacuation location. The policies must address a means to shelter in place, taking into consideration the ability of a building, for example, to survive a disaster and proactive steps that can be taken prior to an emergency.
There must be a system to preserve medical documentation that ensures confidentiality in compliance with HIPAA. There should be procedures for the use of volunteers and the role of State and Federal health officials and then, also, arrangements with other providers to receive patients in the event of limitation or cessation of operations as well as the method for sharing medical documentation with a receiving provider.

21. Communication Plan
The goal of the communication plan requirement is to ensure that patient care is coordinated within the facility, across health care providers, and with State and local public health departments and emergency management systems.
Develop a communication plan that complies with both Federal and State laws.
Include names and contact information for physicians, other health providers, FQHCs, volunteers, State and local emergency preparedness officials.
Coordinate patient care within the facility, across health care providers, and with state and local public health departments and emergency management agencies.
Alternate means of communicating with staff and emergency preparedness officials.
The plan must include names and contact information for physicians, other health providers, FQHCs, volunteers, State and local emergency preparedness officials.
It must include primary and alternate means of communicating with staff and emergency preparedness officials and emergency management agencies such as cell phones or satellite systems. There must be a method to share medical records and patient information, including general location and condition.
A communication plan must be developed as part of the emergency plan that specifically addresses coordination and communication with local, state, and Federal officials.

22. Areas to Consider Alternate means of Communication.
Do we have the Capability to Communicate with all concerned (who is all concerned?).
Getting your Message Out in any way Possible.
Final Standing Orders for Staff (if coms are down…what do we do?).

23. Training and Testing Program
CMS requires providers to conduct one community-based full-scale exercise and a second exercise of their choice.
Test policies and procedures.
Demonstrate knowledge of emergency procedures and test the emergency plan
* If a provider experiences an actual emergency that tests their plan, they MAY be exempt from the requirement for a community-based full-scale exercise for 1 year following the emergency event
** If a community-based full-scale exercise is not feasible, the requirement does provide providers with the flexibility to conduct a testing exercise that is based on the individual facility.
Each covered entity must develop and implement a plan to train all staff on the components of the emergency plan and the policies and procedures and test the ability of the entity to execute the plan, policies and procedures in a simulated exercise environment.
CMS developed this Health Care Provider After Action Report/Improvement Plan (AAR/IP) template to provide a voluntary, user-friendly tool with an organized, thorough approach for gathering details on emergency preparedness exercises and real emergency events to identify areas that may need further improvement. Completion of the CMS AAR/IP template meets any CMS exercise documentation requirements.
This AAR/IP template is based on the U.S. Department of Homeland and Security Exercise and Evaluation Program (HSEEP) Vol. III, issued in February 2007, which includes guidelines that are focused towards emergency management agencies and other governmental/non-governmental agencies. The HSEEP is a capabilities and performance-based exercise program that provides a standardized methodology and terminology for exercise design, development, conduct, evaluation, and improvement planning.

24. Exercise Types Drills Table-Top Functional Full Scale
What do we do now? How can we get involved with exercises Sponsored by other Agencies?

25. What is COOP? Why do we need COOP? Do we have a COOP?
We Have an Emergency Operations Plan (EOP). Isn’t that the same thing?

26. Overview of Continuity Planning Principles
Vocabulary and Terminology
Importance of Planning in Today’s World
Selling and Managing the Planning Process

27. Vocabulary: Continuity of Operations Plan (COOP)
An internal recovery plan for your organization to return to ‘normal’ operations, e.g. “continue” and get back on your feet. Guidance from DHS/FEMA applies to these COOP plans; grant funding often depends on having one in place.

28. Vocabulary: Continuity of Government Plan (COG)
An organization-wide plan which summarizes and collates data from all the individual departmental COOPs. This also relates to the interdependencies between the Executive, Legislative and Judicial Branches.

29. Vocabulary: Business Continuity Plan (BCP)
A plan developed under the guidance of the DRII and other similar professional associations. This is very comparable to the COOP and is primarily a ‘private sector’ term.

30. Vocabulary: Emergency Operations Plan (EOP)
Usually an organization-wide All Hazards response plan for managing emergencies and coordinating all resources and entities during the event. The COOP is technically an annex to the EOP.

31. Vocabulary: Disaster Recovery Plan (DR)
A detailed tactical procedure for the reconstitution of a specific IT system. A lot of DR should be included in any COOP/BCP process, however successful DR does not equal a COOP. Typically DR is heavily technical and IT oriented.

32. Managing the Planning Process
Develop a Planning Team based on Organizational Functional Areas.
Develop Timelines that ensure Plan Development Coincides with Regulatory Guidelines.
Plan for the “When's” and NOT the What if’s.”
Think Outside of the Box.

33. Positions and Planning Responsibilities
Every organization is different and everyone’s planning is unique. How does your organization view emergency and continuity planning?

34. Your Organizational Engine
Interdependencies must be examined and all partners must work together to keep essential functions operational.

35. The Plan – Your Extra Set of Car Keys
A Continuity Plan should clearly define the steps an organization would / could take during times of disruption to ensure they can continue their operations
What type of events could cause a disruption?
Where could/would we go?
How would we communicate and what would we say?
What do we do and what functions are most important?
What equipment and resources are needed to complete our functions?

36. Goals of Planning
Continuity Plans help organizations to understand a variety of factors in order to be better prepared.
Continuity of service
Tolerable levels of service outages
Prioritization of functions across the organization
Legal liabilities and the support of community response
Planning begins with analysis of resources, policies and procedures…

37. A FEMA Compliant COOP
Homeland Security National Continuity Directive 1 (NCD 1) from February 2014, FCD 1, FCD 2, CGC 1/2
Essential Functions – The critical tasks and functions that must continue to be performed.
Orders of Succession – Depth to your organization and who comes next
Delegations of Authority – Those with legislative or executive authority to complete specific actions
Primary and Alternate Facilities – Facilities and their Alternates with Capacity and Interdependencies Identified
Continuity Communications – A comprehensive inventory of communications mechanisms
Vital Records Management – Interdependency Vulnerability and Asset Tracking
Human Capital – Loss of Workforce Calculations and Analysis
Teams, Roles and Responsibilities – Team Delineation and Centralized Coordination of Actions
Test, Training and Exercising – HSEEP and AAR Requirements Annually
Devolution of Control – Identifying Subordinate or Linear Departments
Alert Notification Procedures – Centralized Communications and Redundant Systems Identification

38. Major Sections of a COOP
COOP Contacts and Teams – People and groups responsible for planning, relocation, support and other continuity functions
Orders of Succession – Designating primary positions within an organization and the individuals who possess the skills and experience to assume their responsibilities
Primary and Alternate Facilities – Locations where an organization operates and identified locations to move as required
Mission Essential Functions – The essential functions that an organization is expected to perform to be considered operational
Vital Records/Resources – The “things” an organization relies upon to complete its essential functions
Communication – How do you communicate the information/status with your personnel

39. Contacts
Contacts within your plan will be used to populate future sections within your plan.
Management.
Local, state and federal response agencies.
All staff positions (facility, IT, security and all administrative staff necessary for day to day operations.
Patients.
Critical Vendors and media outlets

40. Communications and Alert Notification
Document all of the procedures your organization has established to communicate during and after a continuity event/disaster.
Call trees.
Publishing information on your organization’s website.
Automated phone notification systems.
Local media outlets.
notifications (work and/or personal ).
Online social media – Facebook / Twitter.
Smoke signals (Think outside of the box).

41. Orders of Succession
Key Personnel / Positions within your organization…. Then Who Comes Next ??

42. Delegations of Authority
Identifying any special Authorities granted to personnel.
Think of Authorities as “Super Powers”
What can they do or not do? ( Does the Board of Directors need to get involved?).
Delegate these “Super Powers” to other “back-up” personnel for use only during times of continuity events or activation.
Identify Triggers and Limitations.

43. Facilities Continuity Plans include three main types of facilities
Primary Facilities - Normal Operations
Alternate Facilities – Options for Relocation of Operations
Third Party Locations for Support

44. Primary Facilities
For each Primary Facility, begin by identifying the following details.
Facility Name and Address
Staffing Levels at Facility
Resources at Facility and Resources needed to be operational (Quantity/Description)
Facility Manager and Contact Information (all contact information)

45. Alternate Facilities
Consider multiple options for relocations with at least one outside of the immediate geographic area of the Primary Facility.
Staff relocating to Facility (how does staff and critical equipment get there)
Resources at Facility vs. Resources Needed
Facility Manager and Contact Information
Agreements and Finances

46. Alternate Facilities
Coordinate with Owners / Managers of both Primary and Alternate Facilities
Visit facility to understand capabilities and layout
Establish Memorandum of Understanding (MOU)
Confirm no other agreements exist (Deconfict)

47. Vital Records / Resources
The important items your organization relies upon to complete its Essential Functions. Examples include:
Software/systems
Spreadsheets
Databases
Specialized programs
Not just electronic documents; they could also be tangible items like maps, manuals, official stamps/seals, printed materials.
Can we go to paper if needed?

48. Vital Records / Resources
This element of a Continuity Plan leads directly into the specific planning for IT Disaster Recovery (DR).
Business Impact Analysis and interdependencies between functions and critical systems
Prioritization of critical IT systems and assets
Backup procedures, locations and recovery times
Steps for re-constitution of these systems
Do you have any work-arounds or alternatives?

49. Mission Essential Functions
Various Terms Used – They are all the SAME Thing
“Mission” Essential Functions
Essential “Business” Functions
Mission Critical Functions
Priority Tasks

50. Essential Functions
The responsibilities / tasks your organization is must complete to be considered operational and support the agency “Mission Statement” and the Community Disaster Response.
Essential Functions describe the incremental working operations of an organization; the most important to the least important and everything in between. Assign priorities to tasks based on Importance and Timelines.
Keep in mind that many Departmental Functions are Co-Dependant.

51. Essential Functions
Examples of Essential Functions from various departments.
Clinical Services
Patient Care
Payroll and Accounts Payable
Facility Operations
Information Technology

52. Essential Functions – Your Engine

53. Testing, Training, and Exercising
Developing your plan is half the battle. Maintaining your plan is the other half.

54. Testing, Training, and Exercising
Not just your Plan…the document Your Personnel as well…. knowledge, awareness, familiarity

55. The best way to prepare is to PRACTICE!!
Tabletop Exercise
The best way to prepare is to PRACTICE!!
Assume this scenario happens as-is and impacts you personally. Exercise your Family Disaster Plan.
Assume the event happens in your ‘home town’ and impacts your primary facility location in addition to Vendors and Response Partners.
Also assume that your facility may not be impacted but may be asked to support Community Disaster Response.
Test MOUs and Vendor Capabilities to determine viability.

56. Testing, Training, and Exercising
One of the most important processes of your plan
Helps identify gaps in your plan
Trains staff on the plan content and the roles each individual plays
Exercises and tests do not always have to be a large, time consuming, or costly event to perform
Learn from your exercises, and update you plan.
Document, Document, Document…If it isn’t written down, it did NOT happen!

57. Getting Started A 1000 mile journey begins with the very first steps…
Get started!! Do something rather than doing nothing.
Engage your co-workers and build a team
Determine the planning framework best suited for your organization
Collaborate!!!!!!!!

58. Best Practices and Lessons Learned
Incorporate past facility disasters into current plans and procedures.
Incorporate lessons learned and best practices from other facilities.
Drill, test, train and exercise (Internally and take advantage of local, state and regional opportunities).
Attend conferences, trainings an workshops hosted by other agencies to promote collaboration and develop partnerships.
Take advantage of assistance organizations (American Red Cross, Salvation Army, Americares and Direct Relief.
Incorporate online planning tools for the development and maintenance of plans and procedures and automated notification systems for both staff and patients.
Engage with potential partners and stakeholders.
Sell the Program and develop coordinated planning teams.

59. Collaboration with the Health Care Coalitions
The CMS EP Rule provides a tremendous opportunity for HCCs to grow their membership and engage with a variety of partners
The CMS rule offers HCCs and newly engaged providers a tremendous opportunity to achieve greater organizational and community effectiveness and financial sustainability through a more inclusive preparedness community.
HCCs will function as an accessible source of preparedness and response best practices as newly engaged provider types adapt to the new requirements.

60. Opportunities for Engagement
HCCs are multi-entity, multidiscipline organizational groups designed to prepare and coordinate the response and recovery of the healthcare system in a community.

61. Communication, Collaboration and Coordination.
How to do it?
Planning (Plan smart as an organizational team and don’t reinvent the wheel).
Communication, Collaboration and Coordination.

62. Mark Fuller (850) 559-9839 fullerm005@gmail.com
Questions / Comments
Mark Fuller (850)