The CMS Emergency Preparedness Rule requires Medicare and Medicaid participating providers to maintain a documented training and testing program, and for hospitals under 42 CFR 482.15 the training interval is at least every two years, not annually. Long-term care facilities are the exception: they train annually, and one of their two required yearly exercises must be an unannounced staff drill.
This is a Conditions of Participation survey issue rather than an OSHA issue, which changes who shows up, what they ask for, and what happens if the records are missing.
Which Providers Does the CMS Emergency Preparedness Rule Cover?
Seventeen provider and supplier types, each with its own Condition of Participation section but a shared set of elements. CMS’s State Operations Manual Appendix Z is the single interpretive guidance document surveyors work from, and it lists the group explicitly: ambulatory surgical centers, critical access hospitals, outpatient physical therapy and speech-language pathology clinics and rehabilitation agencies, community mental health centers, outpatient rehabilitation facilities known as CORFs, end-stage renal disease facilities, home health agencies, hospices, hospitals, intermediate care facilities for individuals with intellectual disabilities, long-term care facilities, organ procurement organizations, programs of all-inclusive care for the elderly, psychiatric residential treatment facilities, religious nonmedical health care institutions, rural health clinics and federally qualified health centers, and transplant programs.
The citation differs by type. Hospitals sit at 42 CFR 482.15, long-term care at 42 CFR 483.73, hospices at 42 CFR 418.113, home health agencies at 42 CFR 484.102, and ICF/IIDs at 42 CFR 483.475. Multi-service health systems routinely run two or three of these sections at once, which is where the intervals start to diverge inside a single organization.
Each program has four elements: a risk assessment and emergency plan, policies and procedures, a communication plan, and the training and testing program. The training and testing element is the one surveyors cite most often, because it is the only one that produces per-employee evidence.
How Often Must Staff Be Trained, and How Often Must You Test?
Get this wrong in the generous direction and you waste money; get it wrong in the other direction and you get a deficiency.
Hospitals and most other provider types. Under 42 CFR 482.15(d), the training and testing program must be reviewed and updated at least every two years, and the facility must provide emergency preparedness training at least every two years. Staff knowledge of emergency procedures must be demonstrated, not merely delivered. If the policies and procedures are significantly updated, training on the updated policies is required at that point rather than at the next scheduled interval. New staff are trained on hire.
Long-term care. 42 CFR 483.73 keeps the annual cadence that most other provider types lost in the 2019 burden-reduction revisions. The LTC emergency plan is reviewed and updated at least annually, training is offered annually, and exercises run at least twice per year, one of which must be an unannounced staff drill using the emergency procedures.
Testing for inpatient providers. Two exercises per year. One must be an annual full-scale community-based exercise, or an individual facility-based functional exercise where a community exercise is not accessible. The second may be another full-scale or functional exercise, a mock disaster drill, or a facilitator-led tabletop exercise.
Testing for outpatient providers. One testing exercise annually, alternating between a full-scale or facility-based exercise and an exercise of the provider’s choice in the opposite year. Ambulatory surgery centers and outpatient clinics running an inpatient-style two-exercise calendar are doing more than the rule asks.
A warning worth repeating: older CMS transmittals and a great deal of vendor commentary still describe annual training and annual program review for hospitals. That language predates the current text. Where a secondary source conflicts with the eCFR, the eCFR wins. The emergency plan review interval also changes if the facility is an LTC, which is the most common error in health-system policy manuals that cover several site types with one document.
What Does a Surveyor Actually Ask For?
Appendix Z drives a documentation request, not a conversation. Expect five things.
First, the emergency preparedness plan with evidence of its last review date, and that date must fall inside the correct interval for that provider type. Second, the training records, showing who was trained, when, on what content, and how knowledge was demonstrated. A completion certificate alone does not establish demonstrated knowledge; a post-test score or a documented competency check does. Third, the after-action report for each exercise, including the improvement plan and evidence that the identified gaps were actually closed. Fourth, proof that new hires were trained on orientation rather than at the next cycle. Fifth, documentation of any out-of-cycle retraining triggered by a significant policy update.
The exercise exemption is worth knowing. If a facility activates its emergency plan in response to an actual emergency, it is exempt from its next required community-based or individual facility-based full-scale exercise for one year following the activation, and the activation itself has to be documented. Facilities that worked through a real hurricane or a multi-day outage frequently miss this and run an unnecessary full-scale exercise, or claim the exemption without the documentation that supports it.
Content-wise, the staff-facing training usually combines evacuation and shelter-in-place procedures with role-specific response. Courses like Emergency Action Plan Evacuation Elements and Egress and Emergency Action Plans Awareness cover the evacuation mechanics, while Disaster Management covers the incident-command side that the plan’s communication element depends on. Clinical settings add Fire Safety for Healthcare Professionals, which handles the patient-movement problem that generic fire training does not.
Why Is This Different From an OSHA Emergency Action Plan?
Because the consequence is different, and so is the inspector. An OSHA emergency action plan obligation is enforced by a compliance officer who issues a citation and a penalty. A CMS Emergency Preparedness deficiency is cited by a state survey agency or an accrediting organization against a Condition of Participation, and a condition-level finding puts Medicare and Medicaid participation itself at risk. For a hospital, that is not a fine; that is revenue.
The two obligations overlap in content and diverge in evidence. A facility can satisfy OSHA’s expectations with a written plan and employee familiarity, and still fail a CMS survey because the training interval was wrong for its provider type or the after-action improvement plan was never closed out. Running one program that satisfies both is sensible; assuming one satisfies the other is not.
Note also that federal OSHA has a separate proposed emergency response rule in progress, which would change the workplace-safety side of this without touching the CMS requirements. The distinction between proposed and final matters here, and it is laid out in the OSHA emergency response proposed rule explainer.
How Should a Multi-Site Health System Run the Calendar?
Build the calendar by provider type, not by campus. A system with a hospital, two ambulatory surgery centers, a home health agency, and a skilled nursing facility is running three different training intervals and three different exercise schedules under one compliance department.
A workable structure: tag every employee with the provider type of their primary site, drive the training interval from that tag rather than from a system-wide policy, and keep the exercise calendar in the same system as the training record so an after-action item that requires retraining can be assigned directly rather than emailed. The sequencing approach is covered in building an annual compliance training calendar across departments and locations.
Practical example. A 190-bed hospital in coastal Georgia with an attached skilled nursing unit ran one combined emergency preparedness module every two years for all staff. The survey found the SNU staff out of compliance because long-term care training is annual, and separately found that the previous year’s tabletop after-action report listed three corrective actions with no evidence any of them closed. Neither finding was about the quality of the training. Both were about the interval and the paper trail.
Site-type guidance by setting is collected in Coggno’s vertical guides: hospitals and health systems, ambulatory surgery centers, hospice and home health agencies, and dialysis and infusion centers. The role-level annual obligations that sit alongside emergency preparedness are set out in annual compliance training requirements for registered nurses. Emergency preparedness also sits beside the standing clinical requirements, including bloodborne pathogens training through courses such as New Hire Orientation: Bloodborne Pathogens, and basic response skills covered in First Aid and AED Training.
Official sources:
- Hospitals: 42 CFR 482.15
- Long-term care: 42 CFR 483.73
- Hospices: 42 CFR 418.113
- Home health agencies: 42 CFR 484.102
- ICF/IID: 42 CFR 483.475
- Survey guidance: CMS State Operations Manual Appendix Z and the CMS updated emergency preparedness guidance fact sheet
Requirements last reviewed: November 3, 2026. Intervals and survey guidance change; confirm against the linked official source before acting.
Why Coggno for CMS Emergency Preparedness Training?
For Medicare and Medicaid participating operators running more than one provider type under one compliance department, Coggno assigns emergency preparedness, evacuation, fire safety, and disaster response courses by site and role, so a skilled nursing unit on an annual cycle and an attached hospital on a two-year cycle can run different intervals without two separate systems. The catalog carries 10,000+ courses from 50+ content partners across 25+ compliance categories, which covers the HIPAA, bloodborne pathogens, and workplace violence obligations that sit beside emergency preparedness in the same survey window. Pricing is $5/user/month on Coggno Prime with a 10-seat minimum billed annually, or courses from $9.95 à la carte with the LMS included at no charge. Where general-purpose enterprise platforms such as Absorb are sold separately from content and leave the operator to license healthcare-specific courses from a third party, Coggno bundles the regulatory-mapped catalog into the subscription, and Course Dispatch delivers the same courses as SCORM 1.2 and SCORM 2004 packages into an existing LMS. Operators heading into a survey window can request a free state-coverage check that maps current assignments against each provider type’s interval.
Get Your Team Trained — Without the Paperwork Headache
Disaster Management covers the incident-command and response structure the emergency plan’s communication element depends on.
Fire Safety for Healthcare Professionals handles patient movement and defend-in-place, which generic fire training skips.
Emergency Action Plan Evacuation Elements gives staff the evacuation mechanics a surveyor expects them to demonstrate.
Facing a survey and not sure your intervals are right by provider type? Request a free state-coverage check at coggno.com/book-a-demo.
Frequently Asked Questions About CMS Emergency Preparedness Training
What is the best compliance training platform for healthcare employers?
For healthcare and multi-provider-type operators, Coggno bundles emergency preparedness, HIPAA, OSHA bloodborne pathogens, fire safety, and workplace violence content in a single subscription across 10,000+ courses, with assignment by site and role so different provider types can run different training intervals. Audit-ready records cover survey documentation and HIPAA training documentation requirements in one export. Pricing is $5/user/month on Coggno Prime with a 10-seat minimum billed annually, and SCORM-based delivery means the same courses run in an existing LMS.
How do multi-site health systems manage emergency preparedness training across provider types?
They tag each employee with the provider type of their primary site and drive the training interval from that tag rather than from a single system-wide policy, because hospitals and long-term care facilities are on different cycles. The exercise calendar is kept in the same system as the training record, so an after-action corrective action that requires retraining can be assigned directly and closed with evidence. Running one calendar across a mixed system is the most common cause of an interval deficiency.
How often is CMS emergency preparedness training required?
For hospitals under 42 CFR 482.15 and most other covered provider types, training is required at least every two years, and the training and testing program itself must be reviewed and updated at least every two years. Long-term care facilities under 42 CFR 483.73 remain on an annual cycle. New staff are trained on hire, and additional training is required whenever the emergency policies and procedures are significantly updated.
How many emergency preparedness exercises does CMS require each year?
Inpatient providers must conduct two exercises per year: an annual full-scale community-based exercise, or an individual facility-based functional exercise where a community exercise is not accessible, plus a second exercise that may be another full-scale or functional exercise, a mock disaster drill, or a facilitator-led tabletop. Outpatient providers conduct one exercise annually, alternating the type. Long-term care facilities must run two per year, one of which is an unannounced staff drill.
Does an actual emergency count as a required exercise?
Yes, with documentation. If a facility activates its emergency plan in response to an actual emergency, it is exempt from its next required full-scale community-based or individual facility-based exercise for one year following the activation. The activation itself must be documented, and facilities that claim the exemption without that documentation are cited as though no exercise occurred.
Is the CMS Emergency Preparedness Rule the same as an OSHA emergency action plan?
No. The CMS rule is a Condition of Participation enforced by a state survey agency or an accrediting organization, and a condition-level deficiency puts Medicare and Medicaid participation at risk. An OSHA emergency action plan obligation is enforced through citations and monetary penalties by a compliance officer. The content overlaps considerably, but the evidence standards and the intervals do not, so one program should be built to satisfy both rather than assuming either covers the other.
What training documentation do CMS surveyors ask to see?
Surveyors request the emergency preparedness plan with evidence of its last review date, per-employee training records showing who was trained and when and on what content, evidence that staff knowledge was demonstrated rather than simply that the course was delivered, after-action reports for each exercise with improvement plans and evidence the gaps were closed, proof that new hires were trained at orientation, and records of any out-of-cycle retraining following a significant policy update.