CMS Should Take Additional Actions To Help Hospitals Prepare for a Future Emerging Infectious Disease Outbreak, A-02-22-01019

Issuer: Office of Inspector General (OIG) audit of the Centers
Document type: Report
Date: 2017-11-15

Summary

An HHS Office of Inspector General audit report, A-02-22-01019, dated July 2025, on whether Centers for Medicare & Medicaid Services (CMS) internal controls were effective in preparing hospitals for a future emerging infectious disease outbreak. It is the second OIG audit of these controls and drew on a nonstatistical sample of five hospitals and interviews with five State Survey Agencies. The report finds CMS controls generally effective but identifies three gaps: surveyors were not trained to cover surge capacity and infection prevention and control, hospital plans did not meet the needs of all at-risk patient populations, and guidance did not address the mental health of frontline staff. OIG made five recommendations, and CMS concurred with all five, with some limitations.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

July 2025 | A-02-22-01019

CMS Should Take Additional
Actions To Help Hospitals Prepare
for a Future Emerging Infectious
Disease Outbreak

OIG.HHS.GOV
July 2025 | A-02-22-01019
CMS Should Take Additional Actions To Help Hospitals Prepare for a
Future Emerging Infectious Disease Outbreak
Why OIG Did This Audit
• Hospitals that cannot control the spread of emerging infectious diseases within their facilities risk
spreading diseases to patients, staff, and the community. This is the second OIG audit of CMS controls
related to hospital preparedness for emerging infectious diseases.
• Our prior audit assessed the design and implementation of CMS controls. This audit assessed the
operating effectiveness of CMS controls related to emerging infectious disease outbreaks.

What OIG Found
Although CMS took significant actions to help hospitals prepare for a future emerging infectious disease
outbreak, we identified gaps in CMS controls that could negatively affect hospital preparedness during a
future event with a scope and duration similar to COVID-19. Specifically:
• CMS did not ensure that surveyors were trained to cover key planning areas for an emerging infectious
disease outbreak.
• CMS did not ensure that hospital emergency preparedness plans met the needs of all at-risk patient
populations.
• CMS’s guidance did not address the mental health of hospital frontline staff as part of hospital
emergency preparedness planning.

What OIG Recommends
We made five recommendations to CMS, including that it collaborate with its emergency preparedness
partners to expand surveyor training, require that hospital accreditation organization standards and survey
processes cover the needs of people from all at-risk patient populations, and encourage hospitals to take into
consideration the mental health of hospital frontline staff as part of emergency preparedness planning. The
full recommendations appear in the report.
CMS concurred with all five recommendations, with some limitations, and described actions it plans to take in
response to our recommendations.

OIG.HHS.GOV
TABLE OF CONTENTS

INTRODUCTION ............................................................................................................................... 1

Why We Did This Audit......................................................................................................... 1

Objective............................................................................................................................... 1

Background ........................................................................................................................... 1
CMS’s All-Hazards Approach to Emergency Preparedness ...................................... 1
Standards for Internal Control in the Federal Government..................................... 2
CMS Controls Related to Emerging Infectious Diseases .......................................... 2

How We Conducted This Audit ............................................................................................ 3

FINDINGS ......................................................................................................................................... 4

CMS Did Not Ensure That Surveyors Were Trained To Cover Key Planning Areas
for an Emerging Infectious Disease Outbreak ................................................................... 4

CMS Did Not Ensure That Hospital Emergency Preparedness Plans Met the Needs
of All At-Risk Patient Populations ...................................................................................... 5

CMS’s Guidance Did Not Address the Mental Health of Hospital Frontline Staff
as Part of Emergency Preparedness Planning ................................................................... 6

Conclusion ............................................................................................................................ 7

RECOMMENDATIONS ..................................................................................................................... 7

CMS COMMENTS AND OIG RESPONSE ........................................................................................... 8

APPENDICES

A: Audit Scope and Methodology ...................................................................................... 10

B: Federal Requirements Related to Emergency Preparedness ........................................ 12

C: Medicare and Medicaid Hospital Surveys ...................................................................... 13

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019)
D: Hospital Operations Toolkit for COVID-19: Capacity
and Infection Prevention and Control......................................................................... 15

E: CMS Comments .............................................................................................................. 17

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019)
INTRODUCTION

WHY WE DID THIS AUDIT

Hospitals that fail to control the spread of emerging infectious diseases within their facilities
risk spreading a disease similar to COVID-19 or mpox to patients, staff and, ultimately, the
community at large. This is the second Office of Inspector General (OIG) audit of the Centers
for Medicare & Medicaid Services (CMS) controls related to hospital preparedness for emerging
infectious diseases.1 Our prior audit assessed the design and implementation of CMS controls.2
This audit addresses the operating effectiveness of CMS controls.

OBJECTIVE

Our objective was to determine whether CMS internal controls were effective in preparing
hospitals for a future emerging infectious disease outbreak.

BACKGROUND

CMS’s All-Hazards Approach to Emergency Preparedness

Hospitals that participate in the Medicare and Medicaid programs must comply with Federal
quality and safety standards. 3 As part of these standards, CMS in 2016 adopted a final rule that
requires an all-hazards approach to emergency preparedness.4 Under this rule, facilities are
required to develop an emergency plan based on a risk assessment, develop policies and
procedures, train staff, and test preparedness. Hospitals and other types of facilities have been
required to implement plans since November 15, 2017.

1
Emerging infectious diseases threaten public health, economic stability, and many everyday activities. Before
COVID-19 and mpox, emerging infectious disease threats included the Ebola disease (2014), H1N1 influenza (2009),
and the severe acute respiratory syndrome (SARS) outbreak of 2003.

2
OIG, CMS's Controls Related to Hospital Preparedness for an Emerging Infectious Disease Were Well-Designed and
Implemented but Its Authority Is Not Sufficient for It To Ensure Preparedness at Accredited Hospitals (A-02-21-
01003), June 24, 2021.

3
Social Security Act § 1861(e); 42 CFR Part 482. CMS’s quality and safety standards are known as “conditions of
participation.”

4
CMS, Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers,
81 Fed. Reg. 63860 (Sept. 16, 2016), codified at 42 CFR § 482.15. An all-hazards approach is an integrated
approach to emergency preparedness that focuses on identifying hazards and developing emergency
preparedness capacities and capabilities that can address hazards as well as a wide spectrum of emergencies or
disasters (CMS State Operations Manual, Appendix Z, Definitions).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 1
In response to a recommendation in an OIG study, 5 CMS in February 2019 added “emerging
infectious diseases” to the definition of the all-hazards approach because CMS “determined it
was critical for facilities to include planning for infectious diseases within their emergency
preparedness program.” 6 See Appendix B for Federal requirements related to hospital
emergency preparedness.

Standards for Internal Control in the Federal Government

Federal agencies, including CMS, are required to comply with Standards for Internal Control in
the Federal Government (Green Book), published by the Government Accountability Office. The
Green Book defines an internal control as a process used by management to help an entity
achieve its objectives and provides criteria for designing, implementing, and operating an
effective internal control system. Among other requirements, an agency must ensure that
controls operate effectively so that objectives will be achieved. A deficiency in operation exists
when a properly designed control does not operate as designed, or when the person
performing the control does not possess the necessary authority or competence to perform the
control effectively.

CMS Controls Related to Emerging Infectious Diseases

CMS’s control objective for hospital emergency preparedness is to ensure that hospitals are
prepared to maintain quality and safety and respond to risks during an emerging infectious
disease outbreak.

Before the emergence of COVID-19, CMS designed and implemented the following controls to
ensure that hospitals maintain quality and safety and respond to risks during an emerging
infectious disease outbreak:

• written guidance such as the CMS State Operations Manual (SOM), Appendix Z, which
provides emergency planning interpretive guidelines for hospitals, and CMS
recommendations and best practices;

• referrals to information and technical assistance resources such as those provided by
the Administration for Strategic Preparedness and Response (ASPR) in the Department
of Health and Human Services (HHS); 7

5
OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Outbreak (OEI-
06-15-00230), Oct. 16, 2018.

6
CMS Memorandum to State Survey Agency Directors, QSO-19-06-ALL (Feb. 1, 2019).

7
ASPR was formerly known as the Office of the Assistant Secretary for Preparedness and Response. On Mar. 27,
2025, HHS announced a restructuring plan that, among other things, would move ASPR under the Centers for
Disease Control and Prevention to enhance coordination of response efforts.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 2
• teleconferences and conference speaking engagements to communicate information or
address provider questions; and

• online training through the CMS Quality, Safety & Education Portal.

After the HHS Secretary declared a public health emergency (PHE) on January 31, 2020, because
of the emerging infectious disease COVID-19, CMS promptly:

• gave additional guidance to health care providers that included references to Centers for
Disease Control and Prevention (CDC) guidance;

• temporarily allowed health care providers not to follow certain rules (e.g., requirements
for telehealth services);

• frequently hosted teleconferences for providers and accreditation organizations (AOs) to
provide information and respond to questions;

• directed State Survey Agencies (SSAs) to reprioritize survey work and perform targeted
infection control surveys of certified hospitals;

• amended the SOM to expand on best practices, lessons learned, and planning
considerations for emerging infectious diseases; 8

• developed training for surveyors designed to identify noncompliance with emergency
preparedness requirements that included emerging infectious disease scenarios; and

• conducted a study of hospital experiences with responding to the COVID-19 pandemic. 9

Currently, CMS relies on several different surveys performed by SSAs and four CMS-approved
AOs to ensure that it meets the control objective for hospital emergency preparedness. See
Appendix C for a description of the types of surveys used by CMS.

HOW WE CONDUCTED THIS AUDIT

We identified CMS’s control objective for hospital emergency preparedness of approximately
500 hospitals certified to participate in Medicare and Medicaid by SSAs and the approximately
4,200 accredited hospitals deemed certified. We then determined whether CMS controls were
operating effectively to achieve that objective with respect to hospital emergency

8
CMS Memorandum to State Survey Agency Directors, QSO 21-15-ALL (Mar. 26, 2021).

9
Blackstock, Sheila C, Jean D. Moody-Williams, and Lee A. Fleisher. “Learnings Regarding Emergency Preparedness
During the Public Health Emergency: A Mixed-Methods Study of Hospitals and Long-Term Care Facilities.” NEJM
Catalyst Innovations in Care Delivery, Aug. 24, 2022. CMS stated that it plans to use the information from this
study to inform its future policy approach on emergency preparedness.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 3
preparedness for an infectious disease outbreak. As part of determining whether CMS controls
were effective in meeting CMS’s control objective, we selected a nonstatistical sample of five
hospitals based on locations (i.e., hospitals in different States) and numbers of COVID-19 cases
resulting in death (i.e., hospitals with the most deaths). 10 We reviewed the selected hospitals’
emergency preparedness programs and interviewed five SSAs associated with the hospitals and
CMS to assess the effectiveness of CMS controls over hospital emergency preparedness for
emerging infectious diseases.

We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.

Appendix A contains the details of our audit scope and methodology.

FINDINGS

CMS controls generally were effective to ensure that hospitals prepare for a future emerging
infectious disease outbreak. However, we identified gaps that could negatively affect hospital
preparedness during a future event with a scope and duration similar to COVID-19. First, CMS
did not ensure that SSA and AO surveyors were trained to cover key planning areas for an
emerging infectious disease outbreak. Second, CMS did not ensure that hospital emergency
preparedness plans met the needs of all at-risk patient populations. Finally, CMS’s update to
the SOM did not address the mental health of hospital frontline staff as part of emergency
preparedness planning.

These gaps occurred due to the difficulty in comprehensively updating training, interpretive
guidelines, recommendations, and best practices in response to an emerging infectious disease
with a scope and duration similar to COVID-19. If CMS does not correct these gaps, hospitals
may not be prepared to maintain quality and safety during a future emerging infectious disease
outbreak.

CMS DID NOT ENSURE THAT SURVEYORS WERE TRAINED TO COVER KEY PLANNING AREAS
FOR AN EMERGING INFECTIOUS DISEASE OUTBREAK

ASPR publishes guidance that identifies key planning areas to help hospitals and other providers
prepare for an emerging infectious disease outbreak. One such guide, published November 30,

10
During our audit period, mpox emerged and was declared a PHE in the United States. Hospitals provided us with
mpox response actions relating to patient placement, personal protective equipment, waste management,
environmental infection control, isolation of exposed patients, and community outreach. Hospitals also provided
the status of mpox testing, vaccines, and treatments. We noted that hospitals at the time of our audit were well
prepared and not overwhelmed with a surge of mpox-infected inpatients. Also, no mpox-related deaths had been
reported at the hospitals we reviewed.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 4
2020, and updated September 20, 2021, was the Hospital Operations Toolkit for COVID-19,
which included two key planning areas: (1) surge capacity and (2) infection prevention and
control. Appendix D provides more information on these key planning areas. To plan for a
future emerging infectious disease, CMS expanded its guidelines for SSAs to generally cover
these key planning areas and referred to ASPR guidance for resources. 11

One control that CMS uses to maintain safety and quality involves exercising oversight of SSA
training of surveyors. Surveyors are trained to evaluate provider compliance with CMS’s
conditions of participation, including emergency preparedness requirements.

CMS did not ensure that surveyors were trained to cover key planning areas for an emerging
infectious disease outbreak. Specifically, CMS’s oversight of SSAs and AOs did not ensure that
surveyors were trained to cover (1) surge capacity and (2) infection prevention and control for
an emerging infectious disease outbreak. The five SSAs we interviewed did not provide
documentation showing that their surveyors had been trained to cover these key planning
areas. Although CMS requires SSA surveyors to take an emergency preparedness basic training
course, the course does not cover these key planning areas. Also, CMS has not ensured that AO
surveyors cover the key planning areas. CMS oversight of AO survey processes is based on
what is required for SSA survey processes. 12

Therefore, CMS may not be assured that hospitals will maintain quality and safety and respond
to risks during an emerging infectious disease outbreak.

CMS DID NOT ENSURE THAT HOSPITAL EMERGENCY PREPAREDNESS PLANS MET THE NEEDS
OF ALL AT-RISK PATIENT POPULATIONS

CMS considers preparedness for an emerging infectious disease outbreak to include plans that
address a hospital’s patient population, including populations at risk. 13 For accredited
hospitals, CMS controls include the approval of AO standards and survey processes to ensure
that hospital emergency preparedness plans meet the needs of all at-risk patient populations.

CMS did not ensure that hospital emergency preparedness plans met the needs of people from
all at-risk patient populations. The standards for all four AOs require hospitals to address
patient populations, including populations at risk. However, the AOs’ standards and survey
processes do not incorporate CMS’s definition of populations at risk. CMS’s accreditation
review process did not correct the definition’s omission from the AOs’ standards and survey
processes.

11
CMS QSO 21-15-ALL.

12
42 CFR § 488.5(a)(4)(ii).

13
CMS defines at-risk populations to include all populations discussed in the National Response Framework and
Public Health Service Act definitions (81 Fed. Reg. 63860, 63875 (Sept. 16, 2016)).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 5
As a result, none of the emergency preparedness plans for the five hospitals we reviewed
addressed all at-risk patient populations, as defined by CMS.

CMS’s GUIDANCE DID NOT ADDRESS THE MENTAL HEALTH OF HOSPITAL FRONTLINE STAFF AS
PART OF EMERGENCY PREPAREDNESS PLANNING

The COVID-19 PHE was in effect for more than 3 years and was the longest duration emergency
event since CMS finalized the emergency preparedness rule in 2016. 14 Research shows that the
PHE took a heavy toll on the mental health and well-being of hospital frontline staff.15, 16 Some
of these workers may suffer post-traumatic stress disorder symptoms for long periods after
treating COVID-19 patients. 17 Stressors among frontline workers during the COVID-19 PHE
included: 18,19

• experiencing an unprecedented number of patient deaths,

• informing family members about the deaths of loved ones who could not be with family,

• illness or death among colleagues,

• fears of getting infected and infecting loved ones,

• longer than usual working periods,

• being deployed to work outside job specialties or disciplines, and

• shortages of personal protective equipment.

14
CMS Proposed Rule, Healthcare System Resiliency and Modernization (CMS-3426-P).

15
Hendrickson, Rebecca C., Roisín A Slevin, Katherine D Hoerster, et al. “The Impact of the COVID-19 Pandemic on
Mental Health, Occupational Functioning, and Professional Retention Among Health Care Workers and First
Responders.” Journal of General Internal Medicine, Feb. 2022.

16
Bradley, Meredith, and Praveen Chahar. “Burnout of healthcare providers during COVID-19.” Cleveland Clinic
Journal of Medicine, July 2020.

17
Restauri, Nicole, and Alison D Sheridan. “Burnout and Posttraumatic Stress Disorder in the Coronavirus Disease
2019 (COVID-19) Pandemic: Intersection, Impact, and Interventions.” Journal of the American College of Radiology,
July 2020.

18
Arnetz, Judith E., Courtney M. Goetz, Bengt B. Arnetz, Eamonn Arble. “Nurse Reports of Stressful Situations
during the COVID-19 Pandemic Qualitative Analysis of Survey Responses.” International Journal of Environmental
Research and Public Health, Nov. 2020.

19
Jervis, Rick, “‘Death is our greeter’: Doctors, nurses struggle with mental health as coronavirus cases grow,” USA
Today, May 5, 2020.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 6
Additionally, a CMS study of provider experiences in responding to the COVID-19 PHE found
that support strategies used by providers to maintain staff resilience were critical for
supporting an effective response as staff fatigue and burnout increased during the PHE.20 Thus,
CMS should encourage hospitals to include mental health support as part of their emergency
preparedness planning. For example, CMS could communicate these support strategies
through recommendations and best practices to hospitals through updates to the SOM.

Although CMS updated the SOM to share lessons learned during the COVID-19 PHE, the update
did not address the mental health of hospital frontline staff. CMS officials said that the SOM
does not address the mental health of hospital staff because they do not believe CMS has
authority to require hospitals to provide mental health services to staff. We noted that CMS
has used the SOM to communicate recommendations and best practices that were not
requirements; therefore, CMS may be able to issue guidance to address the mental health of
hospital frontline staff as part of emergency planning in a future iteration of the SOM. 21

If hospitals do not address the mental health of hospital frontline staff during an emerging
infectious disease, they may not have sufficient staff in good health during and after an
outbreak, which could have a negative effect on the quality and safety of care provided.

CONCLUSION

Although CMS controls are generally effective, hospitals may not be prepared to maintain
quality and safety during a future emerging infectious disease outbreak that shares the scope
and duration of the COVID-19 outbreak. CMS should therefore close the gaps we have
identified in the areas of hospital surveyor training, addressing all at-risk patient populations in
emergency planning, and addressing the mental health of frontline hospital staff to help
hospitals be better prepared for a future emerging infectious disease outbreak.

RECOMMENDATIONS

We recommend that the Centers for Medicare & Medicaid Services:

• collaborate with its emergency preparedness partners to expand SSA surveyor training
to include key planning areas related to emerging infectious diseases consistent with
CMS interpretive guidelines;

• require AO surveyor training to include key planning areas related to emerging
infectious diseases comparable to those included for SSA surveyors;

20
Blackstock, Sheila C, Jean D. Moody-Williams, and Lee A. Fleisher. “Learnings Regarding Emergency Preparedness
During the Public Health Emergency: A Mixed-Methods Study of Hospitals and Long-Term Care Facilities.” NEJM
Catalyst Innovations in Care Delivery, Aug. 24, 2022.

21
For example, CMS’s memorandum QSO 21-15-ALL, which was issued on Mar. 26, 2021, provided guidance on
best practices and lessons learned.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 7
• as part of CMS’s accreditation review process, require AOs’ hospital emergency
preparedness standards to include addressing the needs of individuals from all at-risk
patient populations;

• require that AOs’ hospital survey processes include verifying that hospital emergency
plans address the needs of all at-risk patient populations; and

• encourage hospitals to take into consideration the mental health of hospital frontline
staff as part of emergency preparedness planning.

CMS COMMENTS AND OIG RESPONSE

CMS concurred with all five of our recommendations with some limitations and stated that it will
continue to take actions within its statutory and regulatory authorities related to hospital oversight.
CMS disagreed with our finding that it did not ensure that surveyors were trained to evaluate
provider compliance with emergency preparedness requirements. Specifically, CMS noted that
hospital surveyors were trained to evaluate compliance with the required CMS conditions of
participation and that our finding was based on ASPR’s COVID-19 hospital toolkit guidance. We
acknowledge that our finding was based on the key planning areas identified by ASPR and conclude
that hospital surveyors would benefit from further training on these areas, which CMS has already
added to the SOM. CMS also stated that it will continue to collaborate with ASPR on updates to
trainings, as needed.

CMS stated that it will review guidance for AOs seeking to renew their deemed status to ensure
greater consistency with the regulatory requirement for hospital emergency plans to include plans
for at-risk patient populations. 22, 23

Regarding our recommendation that CMS encourage hospitals to take into consideration the
mental health of hospital frontline staff as part of emergency preparedness planning, CMS stated
that it will encourage hospitals to seek out resources from other Federal agencies and external
entities that work to address the mental health of medical staff.

CMS also provided technical comments, which we addressed as appropriate. CMS’s comments,
excluding technical comments, are included as Appendix E.

22
As described earlier, CMS relies on surveys performed by SSAs and four CMS-approved AOs to ensure that it
meets the control objective for hospital emergency preparedness. CMS-approved AOs must apply to CMS for
approval to conduct deemed status surveys.

23
Deemed status means that CMS has certified a provider or supplier for Medicare participation based on all of the
following criteria having been met: the provider or supplier has voluntarily applied for, and received, accreditation
from a CMS-approved national AO under the applicable Medicare accreditation program; the AO has
recommended the provider or supplier to CMS for Medicare participation; CMS has accepted the AO’s
recommendation; and CMS finds that all other participation requirements have been met (42 CFR § 488.1).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 8
After reviewing CMS’s comments, we believe that the actions CMS described, when fully executed,
should resolve all five of our recommendations.

We thank CMS for its cooperation during this audit.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 9
APPENDIX A: AUDIT SCOPE AND METHODOLOGY

SCOPE

We identified CMS’s control objective for hospital emergency preparedness of approximately
500 hospitals certified to participate in Medicare and Medicaid by SSAs and approximately
4,200 accredited hospitals deemed to be certified. 24 We then determined whether CMS
controls were operating effectively to achieve that objective with respect to hospital
emergency preparedness for an infectious disease outbreak. As part of determining whether
CMS’s internal controls were effective in meeting CMS’s control objective, we selected a
nonstatistical sample of five hospitals based on locations (i.e., hospitals in different States) and
numbers of COVID-19 cases resulting in death (i.e., hospitals with the most deaths). We
reviewed the selected hospitals’ emergency preparedness programs and conducted interviews
with the five SSAs associated with the hospitals and CMS to assess the effectiveness of CMS
controls over hospital emergency preparedness for emerging infectious diseases.

We conducted our audit work from July 2022 through August 2024.

METHODOLOGY

To accomplish our objectives, we:

• reviewed Federal regulations;

• reviewed CMS guidance, correspondence, policies, training, and targeted infection
control survey data;

• reviewed a CMS study on providers’ experiences in responding to the COVID-19
pandemic;

• selected a nonstatistical sample of five hospitals based on their locations (hospitals in
five States covering four regional, core-based statistical areas) and on the number of

24
Certification means a determination made by the SSA that providers and suppliers are in compliance with the
applicable conditions of participation, conditions for coverage, conditions for certification, or requirements (42 CFR
§ 488.1).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 10
COVID-19 cases that resulted in patient deaths; 25

• interviewed hospital emergency management directors and reviewed hospital
emergency preparedness programs, including emergency preparedness plans, risk
analyses, policies, procedures, communication plans, and training programs to
determine compliance with Federal emergency preparedness requirements specifically
related to emerging infectious diseases;

• interviewed hospital executives and reviewed hospital data on COVID-19 cases and
deaths;

• provided written questions and reviewed responses from hospitals regarding their
responses to mpox; 26

• provided written questions, reviewed responses, and conducted interviews with SSAs
associated with five hospitals to determine the operating effectiveness of CMS internal
controls;

• reviewed AOs’ standards and survey processes; and

• discussed our results with CMS officials.

25
A core-based statistical area has a large population nucleus, or urban area, and adjacent communities that have
a high degree of integrating with that nucleus.

26
The HHS Secretary declared mpox a PHE between Aug. 4, 2022, and Jan. 31, 2023.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 11
APPENDIX B: FEDERAL REQUIREMENTS
RELATED TO EMERGENCY PREPAREDNESS

Section 1861(e) of the Social Security Act (the Act) requires hospitals that participate in the
Medicare and Medicaid programs to comply with Federal quality and safety standards. CMS’s
quality and safety standards are included in CMS’s “conditions of participation (CoP).” Federal
regulations (42 CFR § 482.15) establish the emergency preparedness CoP for acute care
hospitals.

Section 1864(a) of the Act requires that the HHS Secretary enter into an agreement with States
under which SSAs determine whether hospitals meet the Medicare CoP.

Section 1865(a) of the Act provides that if a hospital is accredited by a national AO recognized
by the HHS Secretary, it may be deemed to have met the CoP.

42 CFR § 488.5(a) provides the requirements AOs must meet to be approved by CMS, including:

• 42 CFR § 488.5(a)(3), which requires that AOs furnish CMS with a detailed crosswalk that
identifies each applicable Medicare CoP and the exact language of each organization’s
comparable accreditation standards, and

• 42 CFR § 488.5(a)(4), which requires that each AO furnish CMS with a detailed
description of the survey process to confirm that hospitals meet or exceed Medicare
program requirements.

Moreover, 42 CFR § 488.8 provides the requirements for ongoing reviews of AOs.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 12
APPENDIX C: MEDICARE AND MEDICAID HOSPITAL SURVEYS

As a component of its oversight of hospitals, CMS relies on a variety of survey types to assess
hospitals’ compliance with quality and safety requirements. In addition to assessing
compliance, a survey may serve to educate a hospital (e.g., about how to prepare for a surge of
infected patients). The surveys are conducted at the approximately 4,700 hospitals certified to
participate in Medicare and Medicaid by SSAs or deemed to be certified because they are
accredited by an AO. CMS may also elect to have its own surveyors perform a survey at any
time.

ROUTINE SURVEYS

An SSA may certify certain hospitals’ compliance with Medicare and Medicaid quality and safety
requirements after conducting an inspection known as a routine survey. Hospitals that undergo
a routine survey conducted by an SSA, which represent about 10 percent of all Medicare and
Medicaid hospitals, are referred to as “certified hospitals.”

Alternatively, hospitals may voluntarily apply for and receive accreditation from one of four
private AOs, which are approved by CMS. Hospitals accredited by private AOs, which comprise
about 90 percent of all Medicare and Medicaid hospitals, are referred to as “accredited
hospitals.”

CMS pays SSAs for survey work and prioritizes each SSA’s workload. SSAs currently perform
routine surveys of certified hospitals approximately once every 5 years. Each accredited
hospital pays a fee to one of the four AOs. An AO must perform a reaccreditation survey at
least once every 3 years (a triennial survey).

COMPLAINT SURVEYS

As part of CMS’s oversight of certified and accredited hospitals, CMS directs SSAs to perform
complaint surveys. Specifically, an applicable SSA performs a complaint survey after a
complaint is made against a certified hospital. The SSA performs a similar survey at an
accredited hospital after a complaint is made that would, if the complaint’s allegation is proven
true, prove that the hospital was not in substantial compliance with a condition of participation.
SSAs perform about 2,800 complaint surveys per year. Many surveys have identified infection
control deficiencies.

VALIDATION SURVEYS

To measure the effectiveness of AO hospital surveys, CMS ensures that validation surveys are
performed each year at selected accredited hospitals. CMS selects a representative sample of
accredited hospitals each year for a validation survey. Before October 2023, CMS validated an
AO’s routine survey of an accredited hospital by directing an associated SSA to perform a
validation survey within 60 days of completion of an AO’s routine and/or triennial survey of an

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 13
accredited hospital. Since October 2023, CMS has used contractors instead of SSAs to perform
validation surveys. During these surveys, which are now called “direct observation validation
surveys,” a contractor’s surveyors observe AO surveyors during a routine and/or triennial
survey. 27

OTHER SURVEYS INCLUDING SPECIAL SURVEYS

CMS also requires other types of surveys. Some of these surveys are called “special surveys” or
given a specific name and put in place for a limited time. For example, CMS suspended routine
surveys for a period during the COVID-19 PHE and required focused infection control surveys
which were performed by SSAs at certified and accredited hospitals. CMS developed the
focused infection control survey at the beginning of the COVID-19 PHE to help surveyors and
hospitals quickly focus on and absorb critical infection prevention and control practices for
combating COVID-19. After CMS believed hospitals had incorporated COVID-19 management
strategies into their infrastructure and operations, CMS discontinued focused infection control
special surveys and returned to a normal survey protocol.

27
CMS Memorandum to State Survey Agency Directors, QSO Admin Info: 23-14-NLTC (Sept. 6, 2023).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 14
APPENDIX D: HOSPITAL OPERATIONS TOOLKIT FOR COVID-19: CAPACITY
AND INFECTION PREVENTION AND CONTROL

ASPR created the Technical Resources, Assistance Center, and Information Exchange (TRACIE)
to meet the needs of those working in disaster medicine, health care system preparedness, and
PHE preparedness. One TRACIE resource was the Hospital Operations Toolkit for COVID-19,
which included separate sections for two key planning areas—Capacity, and Infection
Prevention and Control. 28

CAPACITY

ASPR created three documents within the toolkit’s Capacity section to help hospitals manage
surge capacity. The documents were:

• “Space,” which discussed maximizing inpatient space, balancing loads with other
hospitals, critical care, hospital-based alternative care sites, nontraditional facility use,
and adjusting services. The document referenced additional resources.

• “Staffing,” which described challenges for staff in critical care nursing, respiratory
therapy, logistics, and environmental services. The document discussed several surge
staffing options and referenced additional resources.

• “Supply Chain,” which discussed and referenced additional resources for general supply
chain issues, selection and acquisition, allocation and inventory management, and
preservation.

INFECTION PREVENTION AND CONTROL

ASPR stated that the health and safety of staff and patients depend on strong infection
prevention and control efforts. ASPR further stated that the hierarchy of controls developed by
CDC offers a framework to protect those in a hospital. ASPR described these controls and
referenced additional resources in four Toolkit documents:

• “Elimination and Substitution Controls,” which referenced additional resources for
reducing exposure to COVID-19 in the workplace.

28
After the issuance of our draft report, ASPR removed many COVID-19-specific resources from its website,
including the Hospital Operations Toolkit for COVID-19. In March 2025, ASPR piloted an online guidebook at
https://asprtracie.hhs.gov/HRROG that includes a “Surge Concepts” chapter that covers the Capacity topics
described in this appendix. Also, CDC maintains the infection prevention and control framework described by
ASPR at Hierarchy of Controls (accessed May 29, 2025).

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 15
• “Engineering Controls,” which discussed modifying physical workspaces to separate
individuals from COVID-19 and reduce their reliance on other controls (e.g., personal
protective equipment). The document referenced additional resources.

• “Administrative Controls,” which discussed policies, procedures, and process changes
that reduce an individual’s exposure to an identified hazard. The document referenced
additional resources.

• “Personal Protective Equipment,” which discussed protecting hospital staff from
occupational exposure to COVID-19.

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 16
APPENDIX E: CMS COMMENTS

CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 17
CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 18
CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 19
CMS Controls Over Hospital Emergency Preparedness for Emerging Infectious Disease (A-02-22-01019) 20
Report Fraud, Waste,
and Abuse
OIG Hotline Operations accepts tips and complaints from all sources about
potential fraud, waste, abuse, and mismanagement in HHS programs. Hotline
tips are incredibly valuable, and we appreciate your efforts to help us stamp
out fraud, waste, and abuse.

TIPS.HHS.GOV
Phone: 1-800-447-8477
TTY: 1-800-377-4950

Who Can Report?
Anyone who suspects fraud, waste, and abuse should report their concerns
to the OIG Hotline. OIG addresses complaints about misconduct and
mismanagement in HHS programs, fraudulent claims submitted to Federal
health care programs such as Medicare, abuse or neglect in nursing homes,
and many more. Learn more about complaints OIG investigates.

How Does It Help?
Every complaint helps OIG carry out its mission of overseeing HHS programs
and protecting the individuals they serve. By reporting your concerns to the
OIG Hotline, you help us safeguard taxpayer dollars and ensure the success of
our oversight efforts.

Who Is Protected?
Anyone may request confidentiality. The Privacy Act, the Inspector General
Act of 1978, and other applicable laws protect complainants. The Inspector
General Act states that the Inspector General shall not disclose the identity of
an HHS employee who reports an allegation or provides information without
the employee’s consent, unless the Inspector General determines that
disclosure is unavoidable during the investigation. By law, Federal employees
may not take or threaten to take a personnel action because of
whistleblowing or the exercise of a lawful appeal, complaint, or grievance
right. Non-HHS employees who report allegations may also specifically
request confidentiality.

1
Stay In Touch
Follow HHS-OIG for up to date news and publications.

OIGatHHS
HHS Office of Inspector General
Subscribe To Our Newsletter
OIG.HHS.GOV

Contact Us
For specific contact information, please visit us online.
U.S. Department of Health and Human Services
Office of Inspector General
Public Affairs
330 Independence Ave., SW
Washington, DC 20201

Email: Public.Affairs@oig.hhs.gov

File and source

File: A-02-22-01019-cms-should-take-additional-actions-to-help-hospitals-prepare-for-a-future-emergi.pdf
Size: 4,164,279 bytes
SHA-256: adc66be64bd86925cfa24eb2847ca9273386b2716c5a10d9de9922b2aad378c8
Our copy: A-02-22-01019-cms-should-take-additional-actions-to-help-hospitals-prepare-for-a-future-emergi.pdf
Original: oig.hhs.gov

CMS Should Take Additional Actions To Help Hospitals Prepare for a Future Emerging Infectious Disease Outbreak, A-02-22-01019

Summary

Full text

File and source

Related records