AAAHC Standards Compliance & CMS s Final Rule on Emergency Preparedness for ASCs

AAAHC Standards Compliance & CMS s Final Rule on Emergency Preparedness for ASCs GSASC / SCASCA Semi-Annual Conference David Shapiro, M.D. 4 Common Themes The Standard deficiencies in Surgical Care settings can be categorized into five themes: Credentialing, Privileging and Peer Review Quality Improvement Infection Prevention and Control Documentation Education and Training 4 1

Common Deficiencies ( 10% incidence) Across Organizations 3 Common Deficiencies in Surgical/Procedural Settings 4 2

Credentialing, Privileging and Peer Review Standard 2.II.B.5.b Upon receipt of the completed reappointment application, the organization will conduct primary or secondary source verification of items listed in Standard 2.II.B.3.c-f. At the time of reappointment consideration by the governing body, the entire reappointment application and peer review results and activities, completed in accordance with Chapter 2.III, will be considered. 9 Credentialing, Privileging and Peer Review Common Deficiencies Observed: Peer review was not incorporated into the reappointment process. Primary source verification was not conducted. Applications were allowed to expire. Failure to follow organization s policy or state requirement for reappointment if it is more frequent than every three years 10 3

Credentialing, Privileging and Peer Review Standard 2.II.D Privileges to carry out specified procedures are granted by the organization to the health care professional to practice for a specified period of time. The health care professional must be legally and professionally qualified for the privileges granted. These privileges are granted based on an applicant s qualifications within the services provided by the organization, and recommendations from qualified medical or dental personnel. 11 Credentialing, Privileging and Peer Review Common Deficiencies Observed: Privileges were granted for procedures not provided by the organization. Delineation of privilege (DOP) lists were missing signatures or not completed as intended (e.g. check boxes left empty throughout document when these exist to indicate specific privileges). DOP lists were missing specific procedures or privileges for anesthesia administration. The Medical Director s privileges were not reviewed by another provider. 12 4

Credentialing, Privileging and Peer Review Standards 2.II.B.5 and 2.II.D Improvement Strategies: Adhere to organization s policy or/and state requirement if time frame for credentialing and privileging is more frequent than AAAHC Standard Follow specific criteria related to the initial appointment and re-appointment process A new application or re-appointment form needs to be completed when requesting re-appointment Review the DOP list to ensure the list reflects the scope of services provided; use core privileges if possible Assign a person to oversee this process, if possible 13 Credentialing, Privileging and Peer Review Standard 2.III.I (2.III.H MDS) The results of peer review are used as part of the process for granting continuation of clinical privileges, as described in Subchapter 2.II. Metric Overall Current Performance Dr. A Dr. B Dr. C Dr. D Dr. E SSI 0.3% 0.5% 0% 0% 1% 0% Patients receiving 91% 75% 98% 92% 93% 98% antibiotics < 1 hour On-time start 67% 75% 64% 72% 45% 78% Time Out 91% 75% 100% 100% 100% 100% Comprehensive H&P 63% 100% 27% 100% 35% 55% 14 5

Credentialing, Privileging and Peer Review Common Deficiencies Observed: Peer review was not incorporated into the reappointment process Lack of peer review process or incomplete process No formal process for comparing peer results, such as a dashboard to identify high and low performers No peer review process for allied health professionals such as nurse practitioners and/or physician assistants Peer review is not performed by a peer No peer review performed for solo providers 15 Credentialing, Privileging and Peer Review Improvement Strategies: Follow a peer review process that uses specific criteria Use a peer review process that goes beyond chart audits Ensure that peer review is incorporated into the reappointment process Use a dashboard or scorecard to compare performance and document peer review Identify performance goals or benchmarks; compare actual performance against the organization s performance goals and analyze overall trends in performance 16 6

Credentialing, Privileging and Peer Review Standard 9.A and 9.F 9.A: Anesthesia services provided by the organization are limited to those techniques that are approved by the governing body upon the recommendation of qualified professional personnel. 9.F: The informed consent of the patient or, if applicable, of the patient s representative, is obtained before the procedure is performed. One consent form may be used to satisfy the requirements of this Standard and Standard 10.I.I. 11 Credentialing, Privileging and Peer Review Common Deficiencies Observed: Anesthesia providers were not granted privileges specific to administering or supervising anesthesia. Surgeons were not granted privileges for local anesthesia. RNs were not granted privileges for anesthesia administration. Surgeons were not granted privileges for supervision. 15 7

Credentialing, Privileging and Peer Review Improvement Strategies: Ensure that privileges granted to anesthesia providers are in alignment with they types of anesthesia services approved by the governing body and include the areas of administration and supervision. Ensure that surgeons and RNs have been granted appropriate privileges for anesthesia administration and supervision. 16 Credentialing, Privileging and Peer Review Standard 10.I.C.2 Surgical procedures must be performed in a safe manner only by qualified providers who: Have been granted clinical privileges to perform those procedures by the governing body in accordance with Chapter 2.II. 11 8

Credentialing, Privileging and Peer Review Common Deficiencies Observed: Privileges were not granted to all providers for all procedures with which they are involved. Privilege lists did not include all procedures performed by the organization. 15 Credentialing, Privileging and Peer Review Improvement Strategies: Schedule routine reviews to ensure that privilege lists are up-to-date and reflect all procedures a provider is involved with. Ensure that privileges granted to providers are in alignment with they types of services approved by the governing body. Clinical privilege lists should be limited to only those types of procedures performed by the organization 16 9

AAAHC Resources For more information: http://www.aaahc.org/en/institute/patient Safety Toolkits1/ For more information: http://www.aaahc.org/en/news/newsletters/ 17 AAAHC Resources: Credentialing, Privileging and Peer Review Worksheets 18 10

Quality Improvement Standard 5.I.C (5.I.E.6 MDS) Written description of QI studies (including the 10 elements) demonstrating that ongoing improvement is occurring within the organization. 2 QI studies need to be submitted with the Application for Survey 1 must be a completed QI study with a corrective action and re-measurement showing improvement, in order for this Standard to be considered for a rating of Substantially Compliant (SC) 19 Quality Improvement Standard 5.I.A.8 (5.I.C.8 MDS) 5.I.A The organization has a written quality improvement program for ensuring ongoing quality and improving performance when needed. The program is broad in scope in order to address clinical, administrative, and cost-of-care performance issues, as well as actual patient outcomes, i.e., results of care, including safety of patients. At a minimum, the written program: 8. Is evaluated at least annually for effectiveness and to determine if the program s purposes and objectives continue to be met. 19 11

Quality Improvement Common Deficiencies Observed: Lack of completed quality improvement study Collect data but do not compare performance Lack of communication about quality improvement to the governing body All elements not addressed Annual effectiveness review not seen 20 Quality Improvement Improvement Strategies: Choose your best and most meaningful QI studies to submit with your application Ensure your process includes collecting data, comparing performance, and determining whether a QI study is needed Set a performance goal that is SMART Use benchmarks, if at all possible, to identify your goal Involve everyone in this process, if possible Use an AAAHC template to ensure all elements are addressed Institute an annual QI program effectiveness review 21 12

Quality Improvement Improvement Strategies Set a performance goal that is SMART S=Specific M=Measurable A=Achievable R=Relevant T=Time-bound Use benchmarks, if at all possible, to set a goal 24 Quality Improvement Worksheets 27 13

AAAHC Resources: Webinar 28 Infection Prevention and Control: Safe Injection Practices Standard 7.I.D.2 (7.I.C.2 MDS) The infection control and prevention program is consistent with CDC or other nationallyrecognized guidelines for safe injection practices One needle, one syringe, one time Single-use vials Multi-dose vials 29 14

Infection Prevention and Control: Safe Injection Practices Common Deficiencies Observed: Not adopting a nationally recognized guideline, or adopting a guideline but not following it Single Use Splitting doses Drawing single-use doses in contaminated room Multi-dose Multi-dose vials accessed in an immediate care area Not labeling with date Pre-drawn syringes not labeled properly 30 Infection Prevention and Control: Safe Injection Practices Standard 9.S and 11.I 9.S: A safe environment for providing anesthesia services is ensured through the provision of adequate space, equipment, supplies, medications, and appropriately trained personnel. Written policies must be in place for safe use of injectables and single-use syringes and needles. All equipment should be maintained, tested, and inspected according to the manufacturer s specifications. A log is kept of regular preventive maintenance. 29 15

Infection Prevention and Control: Safe Injection Practices Standard 9.S and 11.I 11.I: The organization must have policies in place for safe use of injectables and single-use syringes and needles that, at minimum, include CDC or comparable guidelines for safe injection practices. 29 Infection Prevention and Control: Safe Injection Practices Common Deficiencies Observed: Multi-dose vials were accessed in patient care areas. The vials were not wiped with alcohol before being accessed. Anesthetists carried capped syringes in their pockets. 15 16

Infection Prevention and Control: Safe Injection Practices 31 Improvement Strategies: Perform a risk assessment using the nationally recognized guideline you ve adopted Single Use means Single Use Multi-dose vials must be accessed in an area away from a patient treatment area and appropriately labeled USP 797: prepared medications are administered within 1 hour Best practice is to use all multi-dose vials as single use if possible CDC One and Only Campaign http://www.oneandonlycampaign.org/ 32 17

AAAHC Resources: Newsletters For more information: http://www.aaahc.org/en/news/newsletters/ 33 Infection Prevention and Control: Safe Injection Practices Standard 7.II.A.3 7.II.A Elements of an organization s written safety program address the environment of care and the safety of patients, staff, and others, and must meet or exceed local, state, or federal safety requirements. Elements of the safety program include, at a minimum: 3. Policies addressing manufacturer or regulatory agency recalls related to medications, medical equipment and devices, and food products. 29 18

Infection Prevention and Control: Safe Injection Practices Common Deficiencies Observed: A list of look-alike, sound-alike medications was not present. Pre-drawn medications were not labeled. Medications with similar names were stored next to each other. 15 Infection Prevention and Control: Safe Injection Practices Improvement Strategies: Post a list of look-alike, sound-alike medications in patient care and staff-only areas. Establish a routine to spot check that any predrawn medication has been properly labeled. Separate medications with similar names. 16 19

Infection Prevention and Control: Safe Injection Practices Standard 7.II.O The organization has a written policy and process that address the recall of items including drugs and vaccines, blood and blood products, medical devices, equipment and supplies, and food products. At a minimum, the policy addresses documentation of: 1. Sources of recall information (FDA, CDC, manufacturers, and other local, state, or federal sources). 2. How applicable staff members are notified. 3. How the organization determines if a recalled product is present or has been given or administered to patients. 4. Response to recalled products. 5. Disposition or return of recalled items. 6. Patient notification, as appropriate. 29 Infection Prevention and Control: Safe Injection Practices Common Deficiencies Observed: Recall policies did not include food. Patient notification was not included in the recall policies. 15 20

Infection Prevention and Control: Safe Injection Practices Improvement Strategies: Write recall policies to cover all item types Develop methods for identifying patients who came in contact with recalled items with a plan for notification Implement a recall process wherein steps are mapped out 16 Infection Prevention and Control: Safe Injection Practices Standard 7.II.P The organization has a policy for disposal or return of expired medications and supplies that complies with local, state, and federal guidelines. 29 21

Infection Prevention and Control: Safe Injection Practices Common Deficiencies Observed: Expired medications were found during the survey. Expired supplies were found in the crash cart. 15 Infection Prevention and Control: Safe Injection Practices Improvement Strategies: Ensure that a policy has been established for disposal or return of expired medications and supplies that complies with local, state, and federal guidelines Make sure processes are developed and implemented that include a routine schedule to identify and remove expired items 16 22

Documentation Standard 4.E.4 The organization facilitates the provision of high-quality health care as demonstrated by the following: Medication reconciliation is performed. 34 Documentation Common Deficiencies Observed: Medication reconciliation is not being performed If performed, not documented No consistent process is followed (who should be performing it) Improvement Strategies: Create a medication reconciliation policy and/or procedure to help ensure compliance If you are performing medication reconciliation, remember to document 35 23

Documentation Standard 6.F The presence or absence of allergies and untoward reactions to drugs and materials is recorded in a consistent location in the clinical record. 38 Documentation Common Deficiencies Observed: NKA (No Known Allergies) rather than NKDA (No Known Drug Allergies) Reactions were not documented Allergies are not updated Allergies/reaction not documented in a consistent location 39 24

Documentation Improvement Strategies: Record the reaction of drug or material allergy even if it is unknown May need to adjust EMR to allow a freehand option to write in reactions Consult EMR vendor to adjust an option to include an other or unknown category Include over-the-counter medications, materials and reactions Reinforce a policy/education that allergies and reactions are evaluated on every encounter 40 Documentation Standard 8.E.3 The organization conducts scenario-based drills of the internal emergency and disaster preparedness plan. 1. At least one drill is conducted each calendar quarter. 2. One of the quarterly drills is a cardiopulmonary resuscitation (CPR) technique drill, as appropriate to the organization. 3. A written evaluation of each drill is completed. 4. Any needed corrections or modifications to the plan are implemented promptly. 41 25

Documentation Common Deficiencies Observed: There is no written evaluation or summary documenting that an actual drill took place The written evaluation or summary documenting the actual drill (along with ways to improve) has not been shared with employees 42 Documentation Improvement Strategies: Develop a written evaluation to document the drill Create an annual drill calendar Develop a tracking method to ensure employees have attended the required drill(s) Identify facilitator(s) who will conduct and evaluate the drills Create case-based scenario drills. Ensure all supplies and equipment are available. Stage the drill. Develop a corrective action plan, if needed 43 26

AAAHC Resource For more information: http://www.aaahc.org/en/institute/patient Safety Toolkits1/ 43 Documentation Standard 10.I.G (10.I.H MDS) Specific instructions for discontinuation or resumption of medications prior to and after a procedure are provided to the patient with corresponding documentation in the patient s clinical record. 29 27

Documentation Common Deficiencies Observed: Instructions to resume or stop medications were not documented. Patient was instructed to stop medications, but instructions for when to resume were not provided. 15 Documentation Improvement Strategies: Create a process for providing specific patient instructions for discontinuation or resumption of medications prior to and after a procedure with corresponding documentation in the patient s clinical record. Some items to include: Who is responsible? What method is the information delivered by? (for example, a phone call, written info sheet prior to &/or after) Is medication resumption discussed on a post-operative follow-up phone call? How will clinical record documentation be handled? 16 28

Education and Training Standard 7.II.C Medical staff members, allied health providers, employees, volunteers, and others receive safety program education and training and comply with the requirements. 29 Education and Training Common Deficiencies Observed: Failure of physicians to participate in safety training Failure to provide training with the frequency specified in the organizations own policies 15 29

Education and Training Improvement Strategies: Ensure your organization has a safety education policy for medical staff members, allied health providers, employees, volunteers, and others. odevelop a log to track trainings attended and follow-up to remain in compliance with frequency established by policy. 16 CMS s Final Rule on Emergency Preparedness for ASCs 30

CMS s Final Rule on Emergency Preparedness for ASCs On September 8, 2016, the Federal Register posted the final rule Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers. The regulation is effective on November 16, 2016 and must be implemented by November 16, 2017. This final rule establishes a new Condition for Coverage (CfC) for Emergency Preparedness. In June 2017, CMS released an Advanced Copy of the Emergency Preparedness Interpretive Guidelines and Survey Procedures(Appendix Z) which apply to all provider types While most of the material in the CMS documentation applies to all facility types, some aspects does not apply to ASCs. These modifications were largely a result of communications with ASCA and others There are currently no plans to include all of the interpretive guidelines in Appendix L. It appears, however, that the regulatory language in Appendix L will be revised to reflect the recent rule change. Emergency Regulations and the CfCs The new CfC establishes national emergency preparedness standards to ensure adequate planning for both natural and manmade disasters, and coordination with federal, state, tribal, regional and local emergency preparedness systems. A new CfC identifier will be added for ASCs at 42 CFR 416.54. Surveyors conducting surveys after November 16, 2016 will look to determine if the facility is taking necessary steps to assess and revise its emergency preparedness program so that it is on track to meet the regulations by November 16, 2017. 31

CMS s Emergency Regulations The new CfC covers five aspects of emergency preparedness including: Emergency plan Risk Assessment and Planning Policies and Procedures Communication plan (internal and external) Training and testing Emergency Plan: 42 CFR 416.54 (a) ASCs must develop an emergency plan based on risk assessment using an all-hazards approach and develop and update their emergency plan annually. CMS decided that ASCs must include a process for maintaining cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials efforts. ASCs also must document their efforts to contact pertinent emergency preparedness officials and, when applicable, their participation in any collaborative and cooperative planning efforts. 32

Emergency Preparedness Establishment of the Emergency Program (EP) The Ambulatory Surgical Center (ASC) must comply with all applicable Federal, State, and local emergency preparedness requirements. The ASC must establish and maintain an emergency preparedness program that meets the requirements of this section. The emergency preparedness program must include, but not be limited to, the following elements: Develop and Maintain EP Program The ASC must comply with all applicable Federal, State and local emergency preparedness requirements. The ASC must develop establish and maintain a comprehensive emergency preparedness program that meets the requirements of this section. The emergency preparedness program must include, but not be limited to, the following elements: (a) Emergency Plan. The ASC must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually. Maintain and Annual EP Updates (a) Emergency Plan. The ASC must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually. The plan must do the following: (1) Be based on and include a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach. (2) Include strategies for addressing emergency events identified by the risk assessment. Emergency Preparedness EP Program Patient Population The emergency plan must specify the population served within the facility, such as inpatients and/or outpatients, and their unique vulnerabilities in the event of an emergency or disaster. Process for EP Collaboration Emergency Plan. The ASC must develop and maintain an emergency preparedness plan that must be reviewed, and updated at least annually. The plan must do the following: Include a process for cooperation and collaboration with local, tribal, regional, State, and Federal emergency preparedness officials' efforts to maintain an integrated response during a disaster or emergency situation, including documentation of the ASC's efforts to contact such officials and, when applicable, of its participation in collaborative and cooperative planning efforts. Development of EP Policies and Procedures The ASC must develop and implement emergency preparedness policies and procedures, based on the emergency plan of this section, risk assessment, and the communication plan. The policies and procedures must be reviewed and updated at least annually. 33

Emergency Preparedness Procedures for Tracking of Staff and Patients A system to track the location of on-duty staff and sheltered patients in the ASC's care during an emergency. If on-duty staff and sheltered patients are relocated during the emergency, the ASC must document the specific name and location of the receiving facility or other location. Facilities must develop a means to track patients and on-duty staff in the facility s care during an emergency event. In the event staff and patients are relocated, the facility must document the specific name and location of the receiving facility or other location for sheltered patients and on-duty staff who leave the facility during the emergency. Facilities are not required to track the location of patients who have voluntarily left on their own, or have been appropriately discharged, since they are no longer in the facility s care. However, this information must be documented in the patient s medical record should any questions later arise as to the patient s whereabouts. Note: If an ASC is able to cancel surgeries and close (meaning there are no patients or staff in the ASC), this requirement of tracking patients and staff would no longer be applicable. Similarly to ESRD standard practices, if an emergency was imminent and able to be predicted (i.e. inclement weather conditions, etc.) we would expect that ASCs cancel surgeries and cease operations, which would eliminate the need to track patients and staff. Emergency Preparedness Policies and Procedures including Evacuation must address: Safe evacuation from the ASC, which includes the following: (i) Consideration of care needs of evacuees. (ii) Staff responsibilities. (iii) Transportation. (iv) Identification of evacuation location(s). (v) Primary and alternate means of communication with external sources of assistance. Policies and Procedures for Sheltering A means to shelter in place for patients, staff, and volunteers who remain in the ASC. 34

Emergency Preparedness Policies and Procedures for Medical Documents must address the following: (4) A system of medical documentation that does the following: (i) Preserves patient information. (ii) Protects confidentiality of patient information. (iii) Secures and maintains the availability of records. Roles under a Waiver Declared by Secretary The role of the ASC under a waiver declared by the Secretary, in accordance with section 1135 of the Act, in the provision of care and treatment at an alternate care site identified by emergency management officials. Facility s policies and procedures must specifically address the facility s role in emergencies where the President declares a major disaster or emergency under the Stafford Act or an emergency under the National Emergencies Act, and the HHS Secretary declares a public health emergency Emergency Preparedness Emergency Preparation Training and Testing Training refers to a facility s responsibility to provide education and instruction to staff, contractors, and facility volunteers to ensure all individuals are aware of the emergency preparedness program. 1) Training program. The ASC must do all of the following: (i) Initial training in emergency preparedness policies and procedures to all new and existing staff, individuals providing onsite services under arrangement, and volunteers, consistent with their expected roles. (ii) Provide emergency preparedness training at least annually. (iii) Maintain documentation of the training. (iv) Demonstrate staff knowledge of emergency procedures Testing is the concept in which training is operationalized and the facility is able to evaluate the effectiveness of the training as well as the overall emergency preparedness program. Testing includes conducting drills and/or exercises to test the emergency plan to identify gaps and areas for improvement. 35

Emergency Preparedness Emergency Prep Testing Requirements (2) Testing. The ASC must conduct exercises to test the emergency plan at least annually. The ASC must do all of the following: (i) Participate in a full-scale exercise that is community-based or when a community-based exercise is not accessible, an individual, facility-based. If the ASC experiences an actual natural or man-made emergency that requires activation of the emergency plan, the ASC is exempt from engaging in a community-based or individual, facility-based full-scale exercise for 1 year following the onset of the actual event. (ii) Conduct an additional exercise that may include, but is not limited to the following: (A) A second full-scale exercise that is community-based or individual, facilitybased. (B) A tabletop exercise that includes a group discussion led by a facilitator, using a narrated, clinically-relevant emergency scenario, and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan. (iii) Analyze the ASC's response to and maintain documentation of all drills, tabletop exercises, and emergency events, and revise the ASC's emergency plan, as needed. Emergency Preparedness The new regulation requires ASCs to conduct two exercises to test the emergency plan at least annually. While providers and suppliers are encouraged to partner with local and state emergency agencies and health care coalitions to conduct full-scale community exercises, not all agencies and coalitions will have the ability or resources to engage with all providers and suppliers. In such cases, CMS expects those who have been unable to complete a full-scale exercise by November 15, 2017, to complete an individual facility-based exercise and document the circumstances as to why a full-scale, community-based exercise was not completed. The documentation should include what emergency agencies and or health care coalitions the provider or supplier contacted to partner in a full-scale community exercise and the specific reason(s) why a full-scale exercise was not possible. 36

Emergency Preparedness Development of Communication Plan Names and Contact Information Emergency Officials Contact Information Primary/Alternate Means for Communication Methods for Sharing Information Integrated Health Systems If an ASC is part of a healthcare system consisting of multiple separately certified healthcare facilities that elects to have a unified and integrated emergency preparedness program, the ASC may choose to participate in the healthcare system's coordinated emergency preparedness program. If elected, the unified and integrated emergency preparedness program must- (1) Demonstrate that each separately certified facility within the system actively participated in the development of the unified and integrated emergency preparedness program. (2) Be developed and maintained in a manner that takes into account each separately certified facility's unique circumstances, patient populations, and services offered. (3) Demonstrate that each separately certified facility is capable of actively using the unified and integrated emergency preparedness program and is in compliance. (4) Include a unified and integrated emergency plan (5) Include integrated policies and procedures, a coordinated communication plan, and training and testing programs. Preparedness for the Preparedness Develop Emergency Plan: Gather all available relevant information when developing the emergency plan. This information includes, but is not limited to: - Copies of any state and local emergency planning regulations or requirements - Facility personnel names and contact information - Contact information of local and state emergency managers - A facility organization chart - Building construction and Life Safety systems information - Specific information about the characteristics and needs of the individuals for whom care is provided 37

Preparedness for the Preparedness All Hazards Continuity of Operations (COOP) Plan: Develop a continuity of operations business plan using an all-hazards approach (e.g., hurricanes, floods, tornadoes, fire, bioterrorism, pandemic, etc.) that could potentially affect the facility directly and indirectly within the particular area of location. Indirect hazards could affect the community but not the facility and as a result interrupt necessary utilities, supplies or staffing. Determine all essential functions and critical personnel. Collaborate with Local Emergency Management Agency: Collaborate with local emergency management agencies to ensure the development of an effective emergency plan. Preparedness for the Preparedness Analyze Each Hazard: Analyze the specific vulnerabilities of the facility and determine the following actions for each identified hazard: - Specific actions to be taken for the hazard - Identified key staff responsible for executing plan - Staffing requirements and defined staff responsibilities - Identification and maintenance of sufficient supplies and equipment to sustain operations and deliver care and services for 3-10 days, based on each facility s assessment of their hazard vulnerabilities. (Following experiences from Hurricane Katrina, it is generally felt that previous recommendations of 72 hours may no longer be sufficient during some wide-scale disasters. However, this recommendation can be achieved by maintaining 72-hours of supplies on hand, and holding agreements with suppliers for the remaining days.). - Communication procedures to receive emergency warning/alerts, and for communication with staff, families, individuals receiving care, before, during and after the emergency - Designate critical staff, providing for other staff and volunteer coverage and meeting staff needs, including transportation and sheltering critical staff members family 38

Preparedness for the Preparedness Collaborate with Suppliers/Providers: Collaborate with suppliers and/or providers who have been identified as part of a community emergency plan or agreement with the health care facility, to receive and care for individuals. Decision Criteria for Executing Plan: Include factors to consider when deciding to evacuate or shelter in place. Determine who at the facility level will be in authority to make the decision to execute the plan to evacuate or shelter in place (even if no outside evacuation order is given) and what will be the chain of command. Communication Infrastructure Contingency: Establish contingencies for the facility communication infrastructure in the event of telephone failures (e.g., walkie-talkies, ham radios, text messaging systems, etc.). Preparedness for the Preparedness Review Emergency Plan: Complete an internal review of the emergency plan on an annual basis to ensure the plan reflects the most accurate and up-to- date information. Updates may be warranted under the following conditions: - Regulatory change - New hazards are identified or existing hazards change - After tests, drills, or exercises when problems have been identified - After actual disasters/emergency responses - Infrastructure changes - Funding or budget-level changes Refer to FEMA (Federal Emergency Management) to assist with updating existing emergency plans. Review FEMA s new information and updates for best practices and guidance, at each updating of the emergency plans. 39

Other Emergency Preparedness Tools: Cyber Attack Response Checklist Cybersecurity has been prevalent in health care news recently following some high profile ransomware attacks, and it would be prudent for those ASCs that keep electronic PHI to closely consider their cybersecurity protocols. Interruptions in communication, including cyber attacks are included in the elements that ASCs must consider in their EP plans. The Quick-Response Checklist released by the OCR is meant to guide any HIPAA-covered entity through the steps immediately following a cyber attack. This includes both internal response procedures as well as reporting to the OCR, the Department of Health & Human Services and the Department of Homeland Security. The OCR has also created an infographic version of their checklist which may be of use when educating your ASC staff on the appropriate response to a cyberrelated security incident. Facilities are required to both develop and maintain testing and training programs for all EP plan elements by the final rule implementation date on November 15, 2017. Other Emergency Preparedness Tools: Cyber Attack Response Checklist 40

Other Emergency Preparedness Tools: Cyber Attack Response Checklist A Quick Response Checklist from the HHS, Office for Civil Rights (OCR) Must execute its response and mitigation procedures and contingency plans Should report the crime to other law enforcement agencies which may include state or local law enforcement, the Federal Bureau of Investigation (FBI),and/or the Secret Service. Should report all cyber threat indicators to federal and information-sharing and analysis organizations (ISAOs), including the Department of Homeland Security, the HHS Assistant Secretary for Preparedness and Response, and private-sector cyber-threat ISAOs Must report the breach to OCR as soon as possible, but no later than 60 days after the discovery of a breach affecting 500 or more individuals, and notify affected individuals and the media unless a law enforcement official has requested a delay in the reporting. Summary: Components of Preparedness Risk Assessment & Planning Training & Testing Emergency Preparedness Program Policies & Procedures Communication Plan 41

Summary: Components of Preparedness Risk Assessment & Planning: Develop an emergency plan based on a risk assessment. Perform risk assessment using an all-hazards approach, focusing on capacities and capabilities. Update emergency plan at least annually. Policies & Procedures: Develop and implement policies and procedures based on the emergency plan and risk assessment. Policies and procedures must address a range of issues including subsistence needs, evacuation plans, procedures for sheltering in place, tracking patients and staff during an emergency. Review and update policies and procedures at least annually. Summary: Components of Preparedness Communication Plan: Develop a communication plan that complies with both Federal and State laws. Coordinate patient care within the facility, across health care providers, and with state and local public health departments and emergency management systems. Review and update plan annually. Training & Testing Program: Develop and maintain training and testing programs, including initial training in policies and procedures. Demonstrate knowledge of emergency procedures and provide training at least annually. Conduct drills and exercises to test the emergency plan. 42

AAAHC Standards Compliance & CMS s Final Rule on Emergency Preparedness for ASCs GSASC / SCASCA Semi-Annual Conference David Shapiro, M.D. 43