Hazard Vulnerability Analysis and the CMS Emergency Preparedness Rule

A hazard vulnerability analysis (HVA) is the structured process by which a hospital identifies the events that could disrupt it, scores each on how likely it is and how badly it would hurt, and ranks them so that planning effort goes where it matters. It is the document the rest of the emergency preparedness programme is built on — and under the CMS emergency preparedness Condition of Participation, it is the document the rest of the programme is legally required to be built on.

That legal linkage is the part most often missed. 42 CFR 482.15 does not merely require a risk assessment to exist. It requires the emergency plan, the policies and procedures, the communication plan, and the training and testing programme each to be based on that risk assessment. An HVA sitting in a binder, unreferenced by any of those four documents, does not satisfy the rule even though it exists.

What 42 CFR 482.15 actually requires

The Condition opens by requiring the hospital to comply with all applicable federal, state and local emergency preparedness requirements, and to “develop and maintain a comprehensive emergency preparedness program that meets the requirements of this section, utilizing an all-hazards approach.” The programme has five substantive elements.

(a) Emergency plan

Developed and maintained, reviewed and updated at least every 2 years. It must:

1. be based on and include “a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach” — this is the HVA requirement itself, and note that it is two assessments, not one;
2. include strategies for addressing emergency events identified by the risk assessment;
3. address patient population including persons at-risk; the type of services the hospital can provide in an emergency; and continuity of operations including delegations of authority and succession plans;
4. include a process for cooperation and collaboration with local, tribal, regional, state and federal emergency preparedness officials’ efforts to maintain an integrated response.

(b) Policies and procedures

Based on the emergency plan, the risk assessment and the communication plan; reviewed and updated at least every 2 years. At a minimum they must address:

• subsistence needs for staff and patients whether they evacuate or shelter in place — food, water, medical and pharmaceutical supplies; and alternate energy sources to maintain temperatures protecting patient health and safe storage of provisions, emergency lighting, fire detection/extinguishing/alarm systems, and sewage and waste disposal;
• a system to track the location of on-duty staff and sheltered patients, documenting the specific name and location of any receiving facility if they are relocated;
• safe evacuation — care and treatment needs of evacuees, staff responsibilities, transportation, evacuation locations, and primary and alternate means of communication with external sources of assistance;
• a means to shelter in place for patients, staff and volunteers who remain;
• a system of medical documentation preserving patient information, protecting confidentiality, and securing and maintaining availability of records;
• use of volunteers and other emergency staffing strategies, including the process and role for integrating state and federally designated health care professionals to address surge needs;
• arrangements with other hospitals and providers to receive patients if operations are limited or cease;
• the hospital’s role under an 1135 waiver declared by the Secretary, in providing care at an alternate care site identified by emergency management officials.

(c) Communication plan

Compliant with federal, state and local law; reviewed and updated at least every 2 years. It must include names and contact information for staff, entities providing services under arrangement, patients’ physicians, other hospitals and CAHs, and volunteers; contact information for federal, state, tribal, regional and local emergency preparedness staff and other sources of assistance; primary and alternate means for communicating with hospital staff and with emergency management agencies; a method for sharing patient information and medical documentation with other providers to maintain continuity of care; a means in an evacuation to release patient information as permitted under 45 CFR 164.510(b)(1)(ii); a means of providing information about patients’ general condition and location as permitted under 45 CFR 164.510(b)(4); and a means of providing information about occupancy, needs and ability to provide assistance to the authority having jurisdiction, the Incident Command Center, or designee.

(d) Training and testing

Based on the plan, risk assessment, policies and procedures, and communication plan; reviewed and updated at least every 2 years.

Training: initial training in emergency preparedness policies and procedures for all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected role; emergency preparedness training at least every 2 years; documentation maintained; demonstrated staff knowledge of emergency procedures; and additional training whenever policies and procedures are significantly updated.

Testing: exercises to test the emergency plan at least twice per year:

• participate in an annual full-scale exercise that is community-based; or where a community-based exercise is not accessible, conduct an annual individual facility-based functional exercise. If the hospital experiences an actual natural or man-made emergency requiring activation of the emergency plan, it is exempt from its next required full-scale community-based or facility-based functional exercise;
• conduct an additional annual exercise, which may include a second full-scale community-based or facility-based functional exercise; a mock disaster drill; or a tabletop exercise or workshop led by a facilitator, including group discussion using a narrated, clinically relevant emergency scenario and a set of problem statements, directed messages or prepared questions designed to challenge the plan;
• analyze the hospital’s response to, and maintain documentation of, all drills, tabletop exercises and emergency events, and revise the emergency plan as needed.

(e) Emergency and standby power systems

Implemented based on the emergency plan and the subsistence policies. The generator must be located in accordance with the Health Care Facilities Code (NFPA 99, with TIAs 12-2 through 12-6), the Life Safety Code (NFPA 101, with TIAs 12-1 through 12-4) and NFPA 110, when a new structure is built or an existing structure is renovated. Inspection, testing and maintenance follow NFPA 110 and the Health Care Facilities Code. Hospitals maintaining an onsite fuel source must have a plan for keeping emergency power operational during the emergency, unless they evacuate. The specific editions incorporated by reference are NFPA 99 (2012 edition), NFPA 101 (2012 edition) and NFPA 110 (2010 edition) with the listed amendments.

(f) and (g) Integrated systems and transplant programmes

A hospital in a multi-facility system may participate in a unified and integrated emergency preparedness programme, but only if each separately certified facility actively participated in developing it, it accounts for each facility’s unique circumstances, patient populations and services, and each facility is capable of actively using it and is in compliance. Critically, the unified plan must be based on both a documented community-based risk assessment and a documented individual facility-based risk assessment for each separately certified facility in the system — a system-level HVA alone does not satisfy the rule.

Where the hospital has one or more transplant programmes, a representative of each must be included in developing and maintaining the programme, and the hospital must develop and maintain mutually agreed protocols addressing the duties of the hospital, each transplant programme and the OPO for its DSA during an emergency.

The two risk assessments

The requirement at 482.15(a)(1) is for a “facility-based and community-based risk assessment.” These answer different questions and hospitals routinely conflate them.

	Facility-based	Community-based
Asks	What could disrupt this building and this operation?	What could happen in this community that would generate demand on us or cut us off?
Typical hazards	Utility failure, internal flood, fire, IT/cyber outage, supply chain interruption, loss of medical gas, workplace violence, staffing failure	Regional natural hazards, mass casualty incidents, infectious disease outbreak, industrial or transport incidents nearby, civil disturbance, regional infrastructure failure
Built from	Your own systems, building, staffing model, service lines and incident history	Local and state hazard mitigation plans, the healthcare coalition’s regional assessment, local emergency management, public health

The community-based half is where the 482.15(a)(4) cooperation-and-collaboration requirement becomes practical: the credible source for community hazards is the local emergency management agency and the regional healthcare coalition, not the hospital’s own guesswork. Documenting where the community data came from is what demonstrates the collaboration.

How to run the HVA

CMS does not prescribe a method. The following is the structure common to hospital HVA practice; it is a defensible way to satisfy the requirement, not a mandated procedure.

Step 1 — Assemble a multidisciplinary group

An HVA scored by the emergency manager alone is the most common failure. Probability and severity judgements need the people who actually know the systems: facilities and plant operations, clinical leadership from the highest-acuity units, pharmacy, laboratory, supply chain, information security, security, risk management, and — for the community half — a representative from the local coalition or emergency management. In a system, include each facility.

Step 2 — Build the hazard list

Work through hazard categories rather than brainstorming freely, so nothing whole is missed:

• Natural — the meteorological, geological and biological hazards credible for your geography.
• Technological — utility failure, generator failure, medical gas failure, HVAC failure, internal fire or flood, structural damage, equipment failure, transportation disruption.
• Human — mass casualty incident, workplace violence, infant abduction, hostage situation, VIP situation, labour action, staffing shortfall.
• Hazardous materials — internal spill, external release, mass casualty contamination, radiological.
• Cyber and information — ransomware, EHR downtime, network outage, third-party or vendor compromise, medical device compromise.
• Supply chain — drug shortage, blood supply interruption, critical single-source supply failure.

Two categories deserve deliberate attention because HVAs built from older templates under-weight them: extended EHR and network downtime, which now behaves like a utility failure with clinical consequences; and supply chain interruption, which has an unusually long recovery tail.

Step 3 — Score probability and severity

The standard structure scores each hazard on probability (how likely it is to occur) and on several dimensions of severity, then multiplies. Severity is usually decomposed into human impact (injury or death), property impact (physical damage and cost), and business impact (interruption to services), offset by preparedness and response capability — meaning the score reflects residual risk after existing mitigations, which is what should drive further planning.

Two disciplines make the scoring meaningful rather than decorative:

• Anchor the scale before you score. Write down what “high probability” means for your facility — an event expected annually? once in five years? — and what each severity level means in concrete terms. Unanchored 1-to-3 scales produce scores that cannot be compared between hazards or between years.
• Score preparedness honestly. The temptation is to score your own readiness generously, which suppresses the risks most in need of work. If your generator has never been load-tested at full capacity, preparedness for extended power loss is not high.

Step 4 — Rank, and then actually use the ranking

The output is an ordered list. Its purpose is to direct the four downstream documents:

• Emergency plan — 482.15(a)(2) requires strategies for addressing emergency events identified by the risk assessment. Each top-ranked hazard should be traceable to a strategy.
• Policies and procedures — the eight mandatory subjects at 482.15(b) should be written against your highest-ranked hazards, not generically.
• Communication plan — the contacts and alternate means you need depend on which hazards are credible.
• Training and testing — the exercise scenarios for the year should come from the top of the HVA. A tabletop exercising a hazard ranked twenty-third is compliant and useless.

Step 5 — Review and re-run

The plan, policies and procedures, communication plan, and training and testing programme must each be reviewed and updated at least every two years, and each is required to be based on the risk assessment — so the HVA needs to be current at each of those reviews. Annual review is the common practice and is easier to defend. Re-run out of cycle on: a real activation; a significant change in services, building or geography; a new hazard becoming credible; or a change in the community assessment from your coalition.

A usable HVA template structure

An HVA worksheet that satisfies the requirement and stays usable has one row per hazard and the following columns. Build it in whatever tool you like; the columns are the point.

Column	What goes in it
Hazard	Specific, not categorical. “Extended EHR downtime >24h”, not “IT issues”.
Type	Facility-based or community-based. Required to demonstrate both assessments were done.
Probability	Scored against your written, anchored scale.
Human impact	Potential for injury or death.
Property impact	Physical damage and replacement cost.
Business impact	Interruption to clinical services and revenue.
Preparedness	Current plans, training and mitigation in place — scored honestly.
Internal response	Time, effectiveness and resources available in-house.
External response	Community, mutual aid and coalition support realistically available.
Risk score	The computed result. Show the formula on the sheet.
Rank	Position in the ordered list.
Basis / evidence	Why this score — incident history, community plan reference, test result. This column is what turns the HVA from an opinion into an assessment.
Linked plan section	Where in the emergency plan or policies this hazard is addressed. This column is what demonstrates 482.15(a)(2) and (b) compliance.
Owner and review date	Accountability and currency.

The last two columns are the ones that distinguish an HVA that will survive a survey from one that will not. A surveyor asking “how does your plan address your top hazards?” is answered directly by the linked-plan-section column.

Common findings

• Only one risk assessment. 482.15(a)(1) requires facility-based and community-based. In a system, 482.15(f)(4) additionally requires an individual facility-based assessment for each separately certified facility.
• The HVA is not referenced by the documents it is supposed to drive. Four separate provisions require the plan, policies, communication plan and training/testing programme to be based on it.
• Exercise scenarios unrelated to the HVA ranking. Compliant on paper, but it wastes the one or two annual exercises the hospital gets.
• Missing after-action documentation. 482.15(d)(2)(iii) requires analysis and documentation of all drills, tabletop exercises and emergency events, plus revision of the plan as needed. Real events are frequently not documented as rigorously as drills.
• Contracted and volunteer staff excluded from training. The rule covers “all new and existing staff, individuals providing services under arrangement, and volunteers.”
• No 1135 waiver / alternate care site policy. 482.15(b)(8) is a specific required subject and is often absent entirely.
• Onsite fuel with no fuel plan. 482.15(e)(3) requires a plan for keeping emergency power operational during the emergency unless the hospital evacuates.

Where the HVA leads next

The HVA ranks the hazards; the Hospital Incident Command System is how the hospital responds when one of them occurs, and HICS Incident Planning Guides map directly onto the hazards an HVA surfaces. The communication-plan requirement at 482.15(c)(3) — primary and alternate means of communicating with staff and with emergency management agencies — is what drives emergency notification system selection. Where the identified hazard is an infectious disease event, the response is built on transmission-based precautions and, for airborne pathogens, on airborne infection isolation room capacity — a capacity figure that belongs in the HVA’s preparedness score. Blood supply interruption planning is covered in the guide to the walking blood bank.

Frequently asked questions

Is a hazard vulnerability analysis required by CMS?

Yes, in substance. 42 CFR 482.15(a)(1) requires the emergency plan to be based on and include “a documented, facility-based and community-based risk assessment, utilizing an all-hazards approach.” CMS does not use the term “HVA” or prescribe a tool, but the HVA is the standard way hospitals meet this requirement.

How often must an HVA be updated?

The rule sets a two-year review and update cycle for the emergency plan, the policies and procedures, the communication plan, and the training and testing programme — each of which must be based on the risk assessment. In practice that makes a current risk assessment necessary at least every two years; annual review is common practice and easier to defend. Re-run after any real activation or significant change in services, facility or community hazard profile.

What does “all-hazards approach” mean?

An approach that plans for the capabilities common across emergencies — command, communication, evacuation, sheltering, surge, continuity — rather than writing a separate plan per scenario, while still identifying the specific hazards most credible for that facility and community. The term appears four times in 482.15.

How many exercises does CMS require per year?

At least two. One must be an annual full-scale community-based exercise, or a facility-based functional exercise where a community-based one is not accessible. The second may be another full-scale or functional exercise, a mock disaster drill, or a facilitated tabletop exercise or workshop. An actual emergency requiring activation of the plan exempts the hospital from its next required full-scale or functional exercise.

Can a health system do one HVA for all its hospitals?

No. Under 482.15(f)(4), a unified and integrated programme must be based on both a documented community-based risk assessment and a documented individual facility-based risk assessment for each separately certified facility in the system.

Does the HVA have to use a specific scoring formula?

No. CMS prescribes neither a tool nor a formula. What matters is that the assessment is documented, covers both facility and community hazards, uses an all-hazards approach, and demonstrably drives the plan, policies, communication plan and training programme.

Which NFPA editions apply to emergency power?

42 CFR 482.15(h) incorporates by reference NFPA 99 Health Care Facilities Code, 2012 edition (with TIAs 12-2, 12-3, 12-4, 12-5 and 12-6); NFPA 101 Life Safety Code, 2012 edition (with TIAs 12-1, 12-2, 12-3 and 12-4); and NFPA 110 Standard for Emergency and Standby Power Systems, 2010 edition including TIAs to chapter 7.

Do critical access hospitals follow the same rule?

CAHs have their own parallel emergency preparedness Condition of Participation in 42 CFR Part 485. The structure is closely analogous but the text is separate — cite the provision that applies to your certification type rather than 482.15 by default.

Related reading

• Hospital Incident Command System (HICS): Structure, Forms, and How It Is Run
• Choosing emergency notification software for a campus or health system
• Walking Blood Bank: Emergency Donor Programs for Blood-Supply Contingency
• Airborne Infection Isolation Room (AIIR): Specifications and Monitoring
• Transmission-Based Precautions: Contact, Droplet, and Airborne
• Risk Assessment Matrix for Laboratory Hazards: Scoring Severity and Likelihood
• Patient Safety & Infection Prevention