Full text
Department of Health and Human Services
OFFICE OF
INSPECTOR GENERAL
CMS’S CONTROLS RELATED TO
HOSPITAL PREPAREDNESS FOR AN
EMERGING INFECTIOUS DISEASE
WERE WELL-DESIGNED AND
IMPLEMENTED BUT ITS AUTHORITY IS
NOT SUFFICIENT FOR IT TO ENSURE
PREPAREDNESS AT ACCREDITED
HOSPITALS
Amy J. Frontz
Deputy Inspector General
for Audit Services
June 2021
A-02-21-01003
Inquiries about this report may be addressed to the Office of Public Affairs at
Public.Affairs@oig.hhs.gov.
Office of Inspector General
https://oig.hhs.gov
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as amended, is
to protect the integrity of the Department of Health and Human Services (HHS) programs, as well as the
health and welfare of beneficiaries served by those programs. This statutory mission is carried out
through a nationwide network of audits, investigations, and inspections conducted by the following
operating components:
Office of Audit Services
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting audits with
its own audit resources or by overseeing audit work done by others. Audits examine the performance of
HHS programs and/or its grantees and contractors in carrying out their respective responsibilities and are
intended to provide independent assessments of HHS programs and operations. These audits help reduce
waste, abuse, and mismanagement and promote economy and efficiency throughout HHS.
Office of Evaluation and Inspections
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide HHS, Congress,
and the public with timely, useful, and reliable information on significant issues. These evaluations focus
on preventing fraud, waste, or abuse and promoting economy, efficiency, and effectiveness of
departmental programs. To promote impact, OEI reports also present practical recommendations for
improving program operations.
Office of Investigations
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations of fraud and
misconduct related to HHS programs, operations, and beneficiaries. With investigators working in all 50
States and the District of Columbia, OI utilizes its resources by actively coordinating with the Department
of Justice and other Federal, State, and local law enforcement authorities. The investigative efforts of OI
often lead to criminal convictions, administrative sanctions, and/or civil monetary penalties.
Office of Counsel to the Inspector General
The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, rendering
advice and opinions on HHS programs and operations and providing all legal support for OIG’s internal
operations. OCIG represents OIG in all civil and administrative fraud and abuse cases involving HHS
programs, including False Claims Act, program exclusion, and civil monetary penalty cases. In
connection with these cases, OCIG also negotiates and monitors corporate integrity agreements. OCIG
renders advisory opinions, issues compliance program guidance, publishes fraud alerts, and provides
other guidance to the health care industry concerning the anti-kickback statute and other OIG enforcement
authorities.
Notices
THIS REPORT IS AVAILABLE TO THE PUBLIC
at https://oig.hhs.gov
Section 8M of the Inspector General Act, 5 U.S.C. App., requires
that OIG post its publicly available reports on the OIG website.
OFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS
The designation of financial or management practices as
questionable, a recommendation for the disallowance of costs
incurred or claimed, and any other conclusions and
recommendations in this report represent the findings and
opinions of OAS. Authorized officials of the HHS operating
divisions will make final determination on these matters.
Report in Brief
Date: June 2021
Report No. A-02-21-01003
Why OIG Did This Audit
Hospitals that cannot control the
spread of emerging infectious
diseases within their facilities risk
spreading a disease such as COVID-19
to patients and staff. OIG therefore
developed a plan to assess the
Centers for Medicare & Medicaid
Services’ (CMS’s) controls related to
hospital preparedness for emerging
infectious diseases.
The objective of this audit was to
determine whether CMS designed
and implemented effective internal
controls related to hospital
preparedness for emerging infectious
diseases such as COVID-19.
How OIG Did This Audit
We reviewed the design and
implementation of CMS’s controls
regarding the approximately 500
hospitals certified to participate in
Medicare and Medicaid by State
survey agencies under contract with
CMS. We also reviewed CMS’s
controls regarding the approximately
4,200 hospitals known as accredited
hospitals because they have joined a
CMS-approved program operated by
a private accreditation organization.
We limited the scope of our audit to
the design and implementation of
CMS’s controls.
The full report can be found at https://oig.hhs.gov/oas/reports/region2/A22101003.asp.
CMS’s Controls Related to Hospital Preparedness for an
Emerging Infectious Disease Were Well-Designed and
Implemented but Its Authority Is Not Sufficient for It To
Ensure Preparedness at Accredited Hospitals
What OIG Found
CMS’s controls were well-designed and implemented, but CMS’s authority is
not sufficient for it to fulfill its responsibility to ensure that accredited
hospitals would maintain quality and safety during an emerging infectious
disease emergency. Specifically, although CMS announced in February 2019
that it was critical for all hospitals to plan for emerging infectious diseases,
CMS could not determine that all accredited hospitals updated their
emergency preparedness plans to include this planning until 2022 due to
accreditation organizations’ quality and safety inspection cycles. Further,
when COVID-19 emerged in the United States, CMS requested (but could not
require) accreditation organizations to perform special targeted infection
control surveys to help accredited hospitals prepare for COVID-19 patients.
Accreditation organizations performed no such special surveys and, as of
August 17, 2020, State survey agencies only performed these surveys at
about 13 percent of accredited hospitals and had not performed any in
13 States because of CMS’s limited authority over accredited hospitals. As a
result of these limitations, CMS could not ensure that accredited hospitals
would continue to provide quality care and operate safely during the
COVID-19 emergency, and cannot ensure quality and safety at accredited
hospitals when a future emerging infectious disease threatens the United
States.
What OIG Recommends and CMS Comments
We recommend that CMS make regulatory changes to allow it to require
accreditation organizations to perform special surveys after it issues new
participation requirements or guidance and during a public health
emergency to address the risks presented by the emergency.
In written comments on our draft report, CMS concurred with our
recommendation. CMS also indicated that, in March 2021, it updated its
State Operations Manual to include additional planning considerations and
preparedness guidance that expanded on emerging infectious diseases.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
TABLE OF CONTENTS
INTRODUCTION ............................................................................................................................. 1
Why We Did This Audit ..................................................................................................... 1
Objective ........................................................................................................................... 1
Background ....................................................................................................................... 1
The Emergency Preparedness Rule and Emerging Infectious Diseases ............... 1
Standards for Internal Control in the Federal Government ................................. 2
CMS’s Quality and Safety Oversight Controls ....................................................... 2
Other CMS Controls Related to Emerging Infectious Diseases ............................ 5
How We Conducted This Audit ......................................................................................... 6
FINDINGS ....................................................................................................................................... 7
CMS’s Controls Were Well-Designed and Implemented But Its Authority Is Not
Sufficient for It To Ensure Preparedness at Accredited Hospitals ................................. 7
RECOMMENDATION ..................................................................................................................... 8
CMS COMMENTS .......................................................................................................................... 8
APPENDICES
A: Audit Scope and Methodology ..................................................................................... 9
B: CMS Comments .......................................................................................................... 10
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003) 1
INTRODUCTION
WHY WE DID THIS AUDIT
Hospitals that cannot control the spread of emerging infectious diseases within their facilities
risk spreading a disease such as COVID-19 to patients and staff. The Office of Inspector General
(OIG) therefore developed a plan to assess the Centers for Medicare & Medicaid Services’
(CMS’s) controls related to hospital preparedness for emerging infectious diseases. This audit
assesses the design and implementation of CMS’s controls.
OBJECTIVE
Our objective was to determine whether CMS designed and implemented effective internal
controls related to hospital preparedness for emerging infectious diseases such as COVID-19.
BACKGROUND
The Emergency Preparedness Rule and Emerging Infectious Diseases
Hospitals that participate in the Medicare and Medicaid programs must comply with Federal
quality and safety standards.1 In September 2016, CMS adopted a final rule (the Emergency
Preparedness Rule) as part of these standards that requires an all-hazards approach to
emergency preparedness.2 Under this rule, providers were required to develop an emergency
plan based on a risk assessment, develop policies and procedures, train staff, and test
preparedness. Hospitals and other types of facilities were required to implement their plans by
November 15, 2017.
On February 1, 2019, CMS added “emerging infectious diseases” to the definition of the all-
hazards approach because it “determined it was critical for facilities to include planning for
infectious diseases within their emergency preparedness program.”3 Emerging infectious
diseases threaten public health, economic stability, and many normal life activities.4 Previous
1 Social Security Act § 1861(e); 42 CFR Part 482. CMS’s quality and safety standards are known as the “conditions
of participation.”
2 Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers
81 Fed. Reg. 63860 (Sept. 16, 2016), codified at 42 CFR § 482.15. An all-hazards approach is an integrated
approach to emergency preparedness that focuses on identifying hazards and developing emergency
preparedness capacities and capabilities that can address those hazards as well as a wide spectrum of emergencies
or disasters (CMS State Operations Manual, Appendix Z, Definitions).
3 CMS Memorandum to State Survey Agency Directors, QSO-19-06-All (Feb. 1, 2019).
4 Morens D.M., Fauci, A.S., “Emerging Infectious Diseases: Threats to Human Health and Global Stability,” Public
Library of Science Pathogens (July 2013). Available online at
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3701702. Accessed on Mar. 5, 2021.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
2
emerging infectious disease threats included severe acute respiratory syndrome (SARS) and the
H1N1 influenza pandemic in 2009.5 CMS expected hospitals to add emerging infectious
diseases to their plans during their next annual plan update occurring after February 1, 2019.6
Thus, CMS expected that some hospitals would not update their plans until February 1, 2020.
Standards for Internal Control in the Federal Government
Federal agencies, including CMS, are required to comply with the Government Accountability
Office’s (GAO’s) Standards for Internal Control in the Federal Government (Green Book).
Internal control is a process used by management to help an entity achieve its objectives.
GAO’s standards provide criteria for designing, implementing, and operating an effective
internal controls system. Among other requirements, an agency must design control activities
to achieve objectives and respond to risks.
CMS’s Quality and Safety Oversight Controls
As a component of its oversight of hospitals, CMS relies on a variety of survey types to ensure
hospitals’ compliance with quality and safety requirements. The surveys are conducted at the
approximately 4,700 hospitals certified to participate in Medicare and Medicaid by State survey
agencies or deemed to be certified because they are accredited by a private organization.7
Routine Surveys
A State survey agency may certify certain hospitals’ compliance with Medicare and Medicaid’s
quality and safety requirements after conducting an inspection known as a routine survey.8 We
refer to these hospitals, which represent about 10 percent of all Medicare and Medicaid
hospitals, as “certified hospitals.”
Alternatively, hospitals may voluntarily apply for and receive accreditation from one of four
private accreditation organizations, which includes routine surveys by the organization, if CMS
5 See preceding footnote.
6 Each hospital had its own update schedule depending on when it created its plan. On Feb. 1, 2019, CMS required
hospitals to update their plans annually. On Sept. 30, 2019, CMS revised this requirement to at least every 2 years
(84 Fed. Reg. 51732, 51817 (Sept. 30, 2019)).
7 The number of Medicare and Medicaid hospitals was current as of the beginning of our fieldwork and does not
include the approximately 1,350 critical-access hospitals, which are CMS-designated hospitals with no more than
25 beds that meet certain other requirements.
8 The Social Security Act (the Act) § 1864(c).
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
3
has approved the program as meeting or exceeding CMS’s quality and safety requirements.9
We refer to these hospitals, which compose about 90 percent of all Medicare and Medicaid
hospitals, as “accredited hospitals.”
If a routine hospital survey (i.e., quality and safety inspection) by a State survey agency or
accreditation organization identifies deficiencies, the hospital must take corrective action.10 In
addition to ensuring compliance, the survey may serve to educate the hospital (e.g., it could
educate the hospital about how to prepare for a surge of infected patients).
CMS pays State survey agencies for their survey work and prioritizes their workload.11 CMS
informed us that State survey agencies currently perform routine surveys of certified hospitals
approximately once every 5 years. Accredited hospitals pay a fee to one of the four
accreditation organizations. Accreditation organizations must perform reaccreditation surveys
at least once every 3 years (triennial surveys).12
Complaint Surveys
As part of its oversight of certified and accredited hospitals, CMS directs State survey agencies
to perform complaint surveys.13 Specifically, the applicable State survey agency performs one
of these surveys when a complaint is made against a certified hospital.14 The State survey
agency performs a similar survey at an accredited hospital when a complaint is made that
would, if the allegation were true, prove that the hospital was not in substantial compliance
with a participation requirement.15 State survey agencies perform about 2,800 complaint
surveys per year, many of which have identified infection control deficiencies.
9 The Act § 1865(a). CMS “deems” an accredited hospital to be certified to participate in Medicare and Medicaid
when it applies for and receives accreditation from a program that CMS has approved. 42 CFR § 488.1 (deemed
status).
10 42 CFR § 488.28.
11 The Act § 1864(b). CMS directs 80 percent of its survey budget to oversight of long-term care facilities. The
remaining 20 percent is available for oversight of all remaining provider types, including hospitals.
12 Reaccreditation surveys would not be expected to cover all hospitals’ compliance with new guidance related to a
quality or safety requirement that is issued in 2019 until 2022.
13 The Act § 1864(a).
14 The State survey agency performs a survey for those that fit specific criteria, such as a complaint alleging non-
compliance with a condition of participation. See State Operations Manual (Pub. 100-07), Chapter 5.
15 These complaints may result in “immediate jeopardy” or other “condition-level” deficiencies. We refer to these
complaints that allow CMS to direct State survey agencies to conduct surveys as “sufficiently serious complaints.”
Deficiencies that would not cause the hospital to be out of substantial compliance are known as “standard-level”
deficiencies. Standard level-deficiencies at accredited hospitals remain within the jurisdiction of the accreditation
organization, which performs surveys for complaints that could result in a standard-level deficiency.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
4
Validation Surveys
To validate accreditation organization routine surveys of accredited hospitals, CMS directs State
survey agencies to perform about 100 validation surveys per year. These surveys are
performed as a second check, after an accreditation organization has performed a routine
triennial survey at an accredited hospital.16 About 40 percent of validation surveys each year
have identified at least one deficiency not found during the triennial surveys.17 Many validation
surveys have identified infection control deficiencies. Other than these validation surveys, CMS
may not direct a State survey agency to survey an accredited hospital unless there is a
complaint against the hospital.18
Targeted Infection Control Surveys
On March 4, 2020, as part of a series of actions aimed at limiting the spread of COVID-19, CMS
directed State survey agencies to reprioritize survey work to primarily focus on the most serious
complaints, including complaints related to infection control.19 On March 23, 2020, CMS issued
a memorandum to State survey agencies indicating that only complaint and special targeted
infection control surveys would be conducted over a 3-week period ending April 13, 2020.20
CMS did not set an end date for targeted infection control surveys and they continued after
April 13, 2020. The targeted infection control surveys were to use a survey tool provided by
CMS to ensure that providers implemented actions to protect the health and safety of
individuals in response to COVID-19. CMS directed State survey agencies to resume normal
prioritization of surveys on August 17, 2020, but to continue targeted infection control
surveys.21 State survey agencies performed targeted infection control surveys at certified
hospitals and at accredited hospitals over which they had jurisdiction because a sufficiently
serious complaint had been filed from March 2020 through the present.
16 The Act § 1864(c); 42 CFR § 488.9.
17 In its annual Report to Congress, CMS described these deficiencies as “missed” by the accreditation organization.
An average of 43 percent of surveys each year missed one or more deficiency for fiscal years 2014 through 2018.
18 These State survey agency complaint and validation surveys are in addition to the accreditation organizations’
triennial reaccreditation surveys.
19 CMS Memorandum to State Survey Agency Directors QSO-20-12-All (Mar. 4, 2020).
20 CMS Memorandum to State Survey Agency Directors QSO-20-20-All (Mar. 23, 2020). CMS directed State survey
agencies to select hospitals through collaboration with the Centers for Disease Control and Prevention and the
Department of Health and Human Services, Assistant Secretary for Preparedness and Response. In addition to
performing targeted infection control surveys at certified hospitals, if a State survey agency obtained jurisdiction
over an accredited hospital through a sufficiently serious complaint, the State survey agency could perform a
special survey such as a targeted infection control survey at the accredited hospital.
21 CMS Memorandum to State Survey Agency Directors QSO-20-35-All (Aug. 17, 2020).
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
5
Although it could not require accreditation organizations to do so, CMS requested that they
also perform targeted infection control surveys at the nearly 4,200 accredited hospitals
throughout the country; however, as of January 2021, none were performed. Some
accreditation organizations said that they told CMS that they would not perform these surveys
because it was not safe to perform them. The organizations also said that, during this period
when they believed it was not safe to perform targeted infection control surveys, they
performed triennial reaccreditation surveys using remote access technology and placed
additional emphasis on infection control.22 During the period for which CMS directed State
survey agencies to reprioritize surveys (March 4 through August 17, 2020), accreditation
organizations performed 148 triennial surveys and no complaint surveys involving infection
control or emergency preparedness.
Other CMS Controls Related to Emerging Infectious Diseases
In addition to its survey, certification, and accreditation controls, prior to the emergence of
COVID-19, CMS designed and implemented the following controls to ensure that hospitals
maintain quality and safety and respond to risks during an emerging infectious disease
outbreak:
• written guidance, including referring providers to information and technical assistance
resources provided by the Department of Health and Human Services (HHS), Assistant
Secretary for Preparedness and Response’s Technical Resources, Assistance Center, and
Information Exchange (ASPR TRACIE);
• teleconferences and conference speaking engagements to communicate information or
address provider questions; and
• training through CMS’s Quality, Safety & Education Portal.
After the Secretary of HHS declared a public health emergency on January 31, 2020,23 because
of the emerging infectious disease COVID-19, CMS promptly:
22 For example, one accreditation organization said that they mounted a camera on a stand and had someone
wheel the stand around the hospital.
23 Determination That a Public Health Emergency Exists Nationwide as a Result of the 2019 Novel Coronavirus
(Jan. 31, 2020), most recently renewed effective Jan. 7, 2021. Available online at
https://www.phe.gov/emergency/news/healthactions/phe/Pages/2019-nCoV.aspx and
https://www.phe.gov/emergency/news/healthactions/phe/Pages/covid19-07Jan2021.aspx. Accessed on
Mar. 5, 2021.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
6
• issued additional guidance, including referring providers to Centers for Disease Control
and Prevention (CDC) guidance;24
• provided regulatory flexibilities to temporarily allow providers not to follow certain
rules, such as certain requirements for telehealth services;25
• hosted frequent teleconferences for providers and accreditation organizations to
provide information and respond to questions; and
• directed State survey agencies to reprioritize survey work and perform targeted
infection control surveys of certified hospitals.26
HOW WE CONDUCTED THIS AUDIT
We identified CMS’s control objective, which is to ensure that hospitals maintain quality and
safety and respond to risks during an emerging infectious disease outbreak. We then assessed
whether CMS’s related control activities were designed and implemented to achieve this
objective for the approximately 500 hospitals certified to participate in Medicare and Medicaid
by State survey agencies and the approximately 4,200 accredited hospitals deemed to be
certified. Our audit focused on the design and implementation of those control activities.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
Appendix A contains the details of our audit scope and methodology.
24 See, e.g., Memoranda to State Survey Agency Directors QSO-20-09-All (Feb. 6, 2020); QSO-20-13-Hospitals
(Mar. 4, 2020).
25 COVID-19 Emergency Declaration Blanket Waivers for Health Care Providers. Available online at
https://www.cms.gov/files/document/summary-covid-19-emergency-declaration-waivers.pdf. Accessed on
Mar. 5, 2021. The waiver authority is provided when both the Secretary declares a public health emergency and
the President declares a major disaster or national emergency. The President declared a national emergency on
Mar. 13, 2020. Available online at https://www.whitehouse.gov/presidential-actions. Accessed on Mar. 5, 2021.
26 CMS Memoranda to State Survey Agency Directors QSO-20-12-All (Mar. 4, 2020) (reprioritizing surveys only);
QSO-20-20-All (Mar. 23, 2020); QSO-20-35-All (Aug. 17, 2020).
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
7
FINDINGS
CMS’S CONTROLS WERE WELL-DESIGNED AND IMPLEMENTED BUT ITS AUTHORITY IS NOT
SUFFICIENT FOR IT TO ENSURE PREPAREDNESS AT ACCREDITED HOSPITALS
CMS’s controls were well-designed and implemented to achieve its control objective and
respond to risks, but CMS’s authority is not sufficient for it to ensure preparedness for
emerging infectious diseases such as COVID-19 at the 4,200 accredited hospitals. The Green
Book requires that management design control activities to achieve objectives and respond to
risks.27
To meet its objective of ensuring that hospitals maintain quality and safety and respond to risks
during an emerging infectious disease outbreak, CMS developed the Emergency Preparedness
Rule and related guidance, used its existing survey system to identify noncompliance with the
Emergency Preparedness Rule and require corrective action, and responded to infection control
risk when COVID-19 emerged in the United States. Further, CMS referred hospitals to advice
from ASPR TRACIE and CDC.28 Finally, CMS provided training opportunities and engaged in a
communications campaign both before and after the emergence of COVID-19.
These measures were commendable; however, they were not sufficient for CMS to achieve its
control objective of ensuring that hospitals maintain quality and safety and respond to risks
during an emerging infectious disease outbreak at accredited hospitals. CMS added “emerging
infectious diseases” to the definition of the all-hazards approach on February 1, 2019. Because
hospitals were not expected to add emerging infectious disease to their plan until their next
annual update, not all hospitals would have updated their plans until February 1, 2020.
Further, because accreditation organizations are only required to perform reaccreditation
surveys every 3 years, CMS cannot determine whether all 4,200 accredited hospitals updated
their emergency preparedness plans to include emerging infectious diseases until
February 1, 2022.
Additionally, when COVID-19 emerged in the United States, CMS could not evaluate current
infection control compliance at the nearly 4,200 accredited hospitals to determine if they were
prepared to safely handle a surge of infectious patients. Although CMS requested accreditation
organizations to perform COVID-19 related targeted infection control surveys, the accreditation
organizations did not perform any as of January 2021. Some accreditation organizations said
that it was unsafe to perform these special surveys and only performed triennial “virtual”
accreditation surveys through remote technology, though they said they placed an additional
emphasis on infection control. During the period when CMS directed State survey agencies to
reprioritize surveys (March 4 through August 17, 2020), accreditation organizations performed
27 Green Book, “Control Activities,” “Principal – 10 Design Control Activities,” § 10.01.
28 See, e.g., ASPR TRACIE resources web page, and CDC Infection Control Guidance for Healthcare Professionals
about Coronavirus (COVID-19) resources web page. Accessed Mar. 23, 2021.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
8
148 triennial surveys and no complaint surveys involving infection control or emergency
preparedness.
CMS’s authority over State survey agencies mitigated to some extent the effect of accreditation
organizations’ not performing targeted infection control surveys. From March 25 through
August 17, 2020, State survey agencies performed targeted infection control surveys at 548
accredited hospitals.29 However, this number represents only about 13 percent of the
approximately 4,200 accredited hospitals. Moreover, no targeted infection control surveys
were performed in 13 States during this period.30
Because CMS has limited authority over accreditation organizations, it could not achieve its
control objective of ensuring that accredited hospitals maintain quality and safety and respond
to risks during the COVID-19 emergency. Moreover, CMS’s limited authority creates a
significant risk that it will not be able to ensure quality and safety at the nearly 4,200 accredited
hospitals throughout the United States the next time an emerging infectious disease threatens
the country.
RECOMMENDATION
We recommend that the Centers for Medicare & Medicaid Services make regulatory changes to
allow it to require accreditation organizations to perform special surveys of hospitals selected
by CMS:
• after it issues new substantive participation requirements or guidance that it
determines warrant additional validation to ensure timely compliance and
• during a public health emergency to address the risks presented by the emergency.
CMS COMMENTS
In written comments on our draft report, CMS concurred with our recommendation. CMS also
indicated that, in March 2021, it updated its State Operations Manual to include additional
planning considerations and preparedness guidance that expanded on emerging infectious
diseases. CMS also provided technical comments, which we addressed as appropriate. CMS’s
comments, excluding technical comments, are included as Appendix B.
29 As of Mar. 2, 2021, CMS data indicate that State survey agencies had performed targeted infection control
surveys at 982 accredited hospitals.
30 Specifically, no targeted infection control surveys were performed in Alabama, Alaska, Delaware, Georgia,
Massachusetts, Montana, New Hampshire, New Mexico, Oregon, Pennsylvania, South Dakota, Vermont, and
Wyoming. As of March 2, 2021, CMS data indicated that no targeted infection control surveys had been
performed in seven of these States.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
9
APPENDIX A: AUDIT SCOPE AND METHODOLOGY
SCOPE
We identified CMS’s control objective and then assessed whether CMS’s controls were
designed and implemented to achieve its objective regarding the approximately 500 hospitals
certified to participate in Medicare and Medicaid by State survey agencies and the
approximately 4,200 accredited hospitals deemed to be certified. We limited the scope of our
audit to the design and implementation of CMS’s controls
We established reasonable assurance by assessing the data for accuracy and completeness as
applicable to our audit of CMS’s design and implementation controls.
We conducted our audit from April 2020 through April 2021.
METHODOLOGY
To accomplish our objective, we:
• reviewed Federal regulations and Federal Register notices;
• reviewed CMS guidance, correspondence, policies, accreditation documents, survey
data, and training; and accreditation organizations’ policies, survey tools, and reports;
• provided written questions, reviewed responses, and conducted interviews with CMS
and the four accreditation organizations to identify and assess the design and
implementation of CMS’s internal controls;
• reviewed the Green Book components and principles to determine their significance to
our audit objective;
• assessed and documented the design and implementation of CMS’s internal controls to
the extent necessary to address the audit objective; and
• discussed the results of our audit with CMS.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
e:
To:
From:
Subject:
DEPARTMENT OF I IEALTH & HUMAN SERVICES
June 2, 2021
Amy J. Frontz
Deputy Inspector General for Audit Services
Chiquita Brooks-Lasure
Administrator
Centers for Medicare & Medicaid Services
Centers for Medicare & Medicaid Services
Admi11istrator
Washington, DC 20201
Office of Inspector General Draft Rep01i: CMS's Controls Related to Hospital
Preparedness for an Emerging Infectious Disease Were Well-Designed and
Implemented but Its Authority Is Not Sufficient for It To Ensure Preparedness at
Accredited Hospitals (A-02-21-01003)
The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and
comment on the Office oflnspector General (OIG) draft report. CMS takes seriously its role in
emergency preparedness planning.
Hospitals are required to be in compliance with the Federal requirements set forth in the
Medicare Conditions of Participation (CoPs) in order to receive Medicare payments. The CoPs
cover a wide array of topics, including an emergency preparedness requirement that directs
hospitals to implement an all-hazards approach, which is an integrated approach to emergency
preparedness planning that focuses on capacities and capabilities that arc critical to preparedness
for a full spectrum of emergencies or disasters. This approach is specific to the location of the
provider and considers the particular type of hazards most likely to occur in their areas. Hospitals
are required to review and update their emergency preparedness plan at least biennially.
Infection control is always an emergency preparedness priority, and in 2017, to highlight the
importance of infection control, CMS worked with the Centers for Disease Control and
Prevention (CDC) to develop publically available surveyor training that is also used by providers
titled, Universal lnfeclion Prevention and Control. The course provides general infection control
practices and information related to Infections with High Mortality Rates, such as Ebola and the
Flu, which contain elements of preparing for a surge as well as basic infection control practices
that are relevant for all infectious diseases. Additionally, in February 2019, CMS added
additional guidance to the State Operations Manual Appendix Z - Emergency Preparedness to
specifically include emerging infectious diseases. Furthermore, CMS links providers to the
Assistant Secretary for Preparedness and Response (ASPR) Technical Resources, Assistance
Center, and Information Exchange (TRACIE) as a resource for how-to guides, tools, etc., which
has also been referenced in CMS guidance and presentations since 2016. ASPR TRACIE serves
as a public resource for all healthcare preparedness, and has tools and resources specific to
infectious diseases, which are continuously revised and updated. On March 26, 2021, CMS
further updated Appendix Z to include additional planning considerations and preparedness
guidance which expanded on emerging infectious diseases.
APPENDIX B: CMS COMMENTS
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
10
part ofCMS's efforts to oversee hospital compliance with Federal requirements, CMS works
in partnership with State Survey Agencies (SSAs) and Accrediting Organizations (AOs) to
conduct onsite hospital surveys. These surveys are accomplished through observations,
interviews, and document/record reviews. SSAs are also authorized by CMS to conduct
complaint investigations at hospitals, including those deemed by A Os, when substantial
allegations of non-compliance with CoPs are received.
While CMS has oversight responsibilities related to AOs, CMS does not have the same legal
relationship with AOs as with SSAs and cannot direct AO surveys in the same manner. CMS is
able to direct the SSAs to conduct surveys by statutory authority at Section 1864(a) of the Act,
which permits the Secretary to use State health agencies or other appropriate agencies when
determining whether health care entities meet Federal standards. By contrast, CMS approves
A Os under the authority of section l 865(a) of the Social Security Act (Act), which requires the
Secretary to consider factors such as an AO's survey procedures and requirements for
accreditation in determining whether to approve an AO. A Os are required by our regulations at
42 CFR 488.5 to have comparable survey processes and standards that either meet or exceed
those of CMS, as well as meet other specified requirements. The regulations do not require the
AO to perform special surveys at the direction of CMS, such as an infection control survey.
In response to the public health emergency (PHE), CMS issued guidance suspending non
emergency inspections across the country, in order to both contain and limit the spread of
COVID-19, and to direct surveyors to tum their focus to the most serious health and safety
matters, including targeted infection control surveys. The criteria evolved throughout the course
of the PHE to ensure that hospitals implemented the most recent infection control guidance from
both CMS and the CDC. This guidance is applicable to any hospital regardless of whether it is
certified by the SSAs or is deemed by an AO. As mentioned above, while CMS required SSAs to
perform targeted infection control surveys, CMS could only request and encourage AOs to
follow the same survey guidance provided to the SSAs. However, during this time, SSAs
continued to conduct complaint investigations at deemed hospitals, and if during the course of
the complaint survey, non-compliance with a condition such as an infection control requirements
was found, that hospital would be cited and would need to correct the deficiency. Furthermore,
since CMS has reinstated non-emergency surveys, AOs have begun routine surveys at deemed
hospitals.
CMS thanks the OIG for its efforts on this issue and looks forward to working collaboratively on
this and other issues in the future. As the work above shows, and as OIG stated, CMS 's controls
are well-designed and implemented. OIG's recommendations and CMS' responses are below.
OIG Recommendation
CMS should make regulatory changes to allow it to require accreditation organizations to
perform special surveys of hospitals selected by CMS:
•
after it issues new substantive participation requirements or guidance that it determines
warrant additional validation to ensure timely compliance; and
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
11
during a public health emergency to address the risks presented by the emergency.
CMS Response
CMS concurs with making regulatory changes to require AOs to perform special surveys of
hospitals based on CMS's discretion. As OIG acknowledged, CMS's authority over SSAs, and
their ability to conduct complaint surveys, mitigated the extent of the effect of AOs not
performing targeted infection control surveys.
CMS Controls Over Hospital Preparedness for Emerging Infectious Disease (A-02-21-01003)
12