This federal emergency preparedness standard requires facilities to develop and implement policies and procedures for a medical documentation system that preserves patient information, protects confidentiality, and ensures records are secure and available during emergencies. The requirement applies across a broad range of Medicare/Medicaid provider types (hospitals, hospices, home health agencies, long-term care facilities, etc.) and must comply with HIPAA Privacy and Security Rules. It supplements, but does not replace, existing medical records regulations. Surveyors will review the facility's written policies and procedures to verify compliance.
View official sourceE-0023 (Rev. 204, Issued: 04-16-21; Effective: 04-16-21, Implementation: 04-16-21) §403.748(b)(5), §416.54(b)(4), §418.113(b)(3), §441.184(b)(5), §460.84(b)(6), §482.15(b)(5), §483.73(b)(5), §483.475(b)(5), §484.102(b)(4), §485.68(b)(3), §485.625(b)(5), §485.727(b)(3), §485.920(b)(4), §486.360(b)(2), §491.12(b)(3), §494.62(b)(4). [(b) Policies and procedures. The [facilities] must develop and implement emergency preparedness policies and procedures, based on the emergency plan set forth in paragraph (a) of this section, risk assessment at paragraph (a)(1) of this section, and the communication plan at paragraph (c) of this section. The policies and procedures must be reviewed and updated at least every 2 years [annually for LTC facilities]. At a minimum, the policies and procedures must address the following:] [(5) or (3),(4),(6)] A system of medical documentation that preserves patient information, protects confidentiality of patient information, and secures and maintains availability of records. *[For RNHCIs at §403.748(b):] Policies and procedures. (5) A system of care documentation that does the following: (i) Preserves patient information. (ii) Protects confidentiality of patient information. (iii) Secures and maintains the availability of records. *[For OPOs at §486.360(b):] Policies and procedures. (2) A system of medical documentation that preserves potential and actual donor information, protects confidentiality of potential and actual donor information, and secures and maintains the availability of records. Interpretive Guidelines applies to: §403.748(b)(5), §416.54(b)(4), §418.113(b)(3), §441.184(b)(5), §460.84(b)(6), §482.15(b)(5), §483.73(b)(5), §483.475(b)(5), §484.102(b)(4), §485.68(b)(3), §485.625(b)(5), §485.727(b)(3), §485.920(b)(4), §486.360 (b)(2), §491.12(b)(3), §494.62(b)(4). NOTE: This does not apply to Transplant Programs. In addition to any existing requirements for patient records found in existing laws, under this standard, facilities are required to ensure that patient records are secure and readily available to support continuity of care during an emergency. This requirement does not supersede or take away any requirements found under the provider/supplier’s medical records regulations, but rather, this standard adds to such regulations. These policies and procedures must also be in compliance with the Health Insurance Portability and Accountability Act (HIPAA), Privacy and Security Rules at 45 CFR parts 160 and 164, which protect the privacy and security of individual’s personal health information. Survey Procedures • Ask to see a copy of the policies and procedures that documents the medical record documentation system the facility has developed to preserves patient (or potential and actual donor for OPOs) information, protects confidentiality of patient (or potential and actual donor for OPOs) information, and secures and maintains availability of records.