Most nursing home emergency plans are written around fires, storms and power failures. They cover generators, evacuation routes and food and water. What they often leave thin is the part that fails first in almost every one of those emergencies: the computers, the internet connection and the phones that staff use to document care and reach families.
The CMS emergency preparedness rule for long-term care facilities, 42 CFR 483.73, never uses the word “IT” in its headings. But several of its requirements can only be met with working technology, and surveyors check them. Here is where IT fits, section by section.
Medical documentation: the requirement written for IT
Under the policies and procedures section, the rule requires a system of medical documentation that preserves resident information, protects the confidentiality of resident information, and secures and maintains the availability of records.
That is three separate tests, and each one maps to something concrete:
- Preserves resident information. Backups. Your EHR vendor backs up the application, but anything stored locally, such as scanned documents, spreadsheets on a shared drive, or files on the administrator’s computer, is your responsibility.
- Protects confidentiality. Encryption on laptops and backup drives, controlled logins, and a plan for paper records printed during downtime. Printed MARs left on a cart after the outage are still protected health information.
- Maintains availability. A way to reach records when the building’s internet or power is gone. For PointClickCare facilities that often means the eMAR Backup tool on a computer with battery or generator power, plus a printer on the same backup circuit.
Ask your IT provider to show you, not tell you, that each of these works. A backup that has never been restored is a hope, not a backup.
The communication plan depends on systems that may be down
The rule requires a communication plan, reviewed at least annually, with contact information for staff, residents’ physicians, other long-term care facilities, volunteers, emergency agencies, the state licensing agency and the state long-term care ombudsman. It also requires primary and alternate ways to communicate with staff and emergency management agencies.
The IT questions to ask:
- Where does the contact list live? If it only exists in your EHR, email or a shared drive, it disappears in the outage it was written for. Keep a current printed copy and an offline copy.
- What is the alternate method? If your phone system runs over the internet, an internet outage takes out the phones too. Cell phones, a cellular backup for the phone system, or a separate analog line for key numbers are common alternates. Decide which one you use and test it.
- How will you share records with a receiving facility? The rule calls for procedures to share medical information with other providers and to release information during an evacuation. Know how you would get records out of your EHR if residents had to move.
Training and testing: use your outages
Long-term care facilities must conduct exercises at least twice a year, and the rule requires facilities to analyze their response to drills, tabletop exercises and actual emergencies, document it, and revise the plan as needed.
An EHR or internet outage is a natural tabletop scenario, and a real one is an actual emergency you can document. Questions worth walking through: how long until staff switched to paper, whether the backup reports printed, who called the IT provider and how long it took, and how documentation was caught up afterward.
Power: the generator and the network closet
The rule’s emergency and standby power section is mostly about generators and fire code. The IT question is narrower: when the building is on generator power, what actually comes back? Confirm that the network closet, the firewall, the internet modem, at least one Wi-Fi path to each unit, the eMAR backup computer and its printer are on generator-backed circuits or a battery backup that lasts until the generator takes over. A generator that runs the lights while the network switch stays dark leaves staff charting on paper anyway.
Review it every year, not every two
CMS eased the review schedule for many provider types in 2019, but long-term care facilities still have to review and update the emergency plan, policies and procedures, communication plan and training program at least annually. Build the IT review into that cycle: update the contact lists, re-test a backup restore, and check that every new device and system added during the year is covered.
A short IT checklist for your next plan review
- Restore a backup and record the date and result.
- Confirm the eMAR backup computer and printer are on backup power and receiving current files.
- Print the communication plan contact list and keep an offline copy.
- Test the alternate communication method.
- Confirm what network equipment runs on generator power.
- Document the last IT outage as an exercise or actual event.
RDE Technologies supports skilled nursing facilities with managed IT, backups, network and wireless setup, and HIPAA-ready security. Start with our free HIPAA security risk assessment, a one-hour remote session with a written report within 5 days, or read how we provide IT support for skilled nursing facilities.
Source: 42 CFR 483.73, Emergency preparedness (long-term care facilities). This article is general information, not legal or regulatory advice; check current CMS guidance with your compliance team.