National Preparedness Month: What Emergency Training Should Healthcare Employers Provide?

September is National Preparedness Month, making it an ideal time for healthcare organizations to evaluate whether employees are prepared to respond when normal operations are disrupted. In 2026, FEMA’s National Preparedness Month campaign emphasizes how “Americans Stand Ready” by understanding their risks, making plans, preparing supplies, and knowing how to respond when emergencies occur (Federal Emergency Management Agency).

For healthcare employers, preparedness involves more than identifying the nearest exit. Employees may need to protect patients who cannot evacuate independently, maintain essential clinical services, safeguard protected health information, communicate during technology outages, and respond to hazards ranging from fires and severe weather to violence, infectious disease outbreaks, chemical releases, and cyberattacks.

Key Answer: Healthcare emergency preparedness training should cover emergency reporting, alarms, evacuation, shelter-in-place procedures, patient assistance, fire safety, workplace violence, infection control, hazardous exposures, utility failures, cybersecurity downtime, HIPAA privacy, continuity of care, and each employee’s responsibilities under the facility’s emergency plan.

What emergency preparedness training should healthcare employers provide?

Healthcare emergency preparedness training should teach employees how to:

• Recognize the facility’s reasonably anticipated emergencies.
• Report an emergency and activate the appropriate response.
• Understand alarms, alerts, emergency codes, and communication methods.
• Evacuate, shelter in place, or secure the facility.
• Assist patients, visitors, and people with mobility or communication limitations.
• Respond to fires, hazardous-material incidents, infectious exposures, violence, and utility failures.
• Protect patient information during emergencies and system outages.
• Perform their assigned responsibilities under the organization’s emergency plan.
• Document incidents and participate in drills, exercises, and post-event reviews.

The exact training required depends on the facility’s hazards, emergency plan, workforce responsibilities, state law, accreditation requirements, and whether the organization participates in Medicare or Medicaid.

Why is emergency preparedness different in healthcare?

A conventional workplace may be able to evacuate employees and suspend operations. Healthcare organizations often cannot.

Hospitals, nursing facilities, ambulatory surgery centers, physician practices, dialysis facilities, behavioral health organizations, home health agencies, hospices, pharmacies, and other healthcare providers may have patients who:

• Cannot walk or evacuate without assistance.
• Depend on oxygen, dialysis, refrigeration, or electrically powered medical equipment.
• Need continuous medication or clinical monitoring.
• Have cognitive, behavioral, hearing, visual, or communication limitations.
• Are undergoing a procedure when an emergency begins.
• Must be transferred without interrupting critical care.

Healthcare emergency training must therefore connect general workplace safety with patient protection, clinical continuity, privacy, infection control, and facility-specific procedures.

Are healthcare employers required to provide emergency preparedness training?

Several federal requirements may apply, but there is no single training rule covering every healthcare employer and every emergency.

An organization should evaluate at least four potential sources of obligations:

1. Occupational Safety and Health Administration requirements.
2. Centers for Medicare & Medicaid Services requirements.
3. HIPAA privacy and security requirements.
4. State law, licensing, fire-code, and accreditation requirements.

Employers should distinguish between training that is expressly required and training that represents a prudent component of an effective emergency-preparedness program.

What does OSHA require for emergency action plans?

OSHA’s Emergency Action Plan standard, 29 C.F.R. § 1910.38, applies when another OSHA standard requires an employer to maintain an emergency action plan. Many organizations also adopt one voluntarily as a basic workplace-safety practice.

When required, the plan must address:

• How fires and other emergencies will be reported.
• Procedures for emergency evacuation and assigned exit routes.
• Procedures for employees who must perform critical operations before evacuating.
• Methods for accounting for employees after evacuation.
• Rescue and medical responsibilities assigned to employees.
• The names or job titles of people employees can contact for more information.

An employer must designate and train employees who will assist with a safe and orderly evacuation. The employer must also review the emergency action plan with each employee when the plan applies to the employee, when the employee’s responsibilities change, and when the plan itself changes (Occupational Safety and Health Administration, “Emergency Action Plans”).

A written plan must generally be maintained and available for employee review. An employer with ten or fewer employees may communicate the plan orally.

What should employees learn about evacuation?

Facility-specific evacuation training should address:

• Primary and alternate exit routes.
• The meaning of facility alarms and emergency codes.
• Designated assembly or accountability locations.
• Who may order an evacuation.
• Who is responsible for checking rooms and closing doors.
• How employees will account for coworkers, patients, and visitors.
• Procedures for moving patients who need assistance.
• When elevators must not be used.
• How to respond if smoke, flooding, debris, or security threats block an exit.
• When employees should evacuate, shelter in place, or secure their location.
• Where employees can obtain updated instructions.

Generic online training can establish foundational knowledge, but employees must also receive instruction on their own facility’s exits, alarms, patient-movement procedures, emergency codes, and assigned responsibilities.

What does CMS require from participating healthcare providers?

The CMS Emergency Preparedness Rule applies to specified Medicare- and Medicaid-participating provider and supplier types. Covered organizations must maintain an emergency-preparedness program built around four core elements:

1. A risk assessment and emergency plan.
2. Policies and procedures.
3. A communication plan.
4. A training and testing program.

The program must use an all-hazards approach that addresses emergencies reasonably likely to affect the facility and its patient population. Relevant hazards may include severe weather, fire, utility loss, communications failure, cyberattack, supply disruption, infectious disease, patient surge, evacuation, and loss of part or all of the facility (Centers for Medicare & Medicaid Services, “Core EP Rule Elements”).

How often does CMS require emergency preparedness training?

CMS training frequency is not identical for every provider type.

For example, the current hospital regulation requires the emergency-preparedness training and testing program to be reviewed and updated at least every two years. Hospital employees must receive initial emergency-preparedness training consistent with their expected roles, demonstrate knowledge of emergency procedures, and receive additional training at least every two years. Training must also occur when emergency policies and procedures are significantly updated (42 C.F.R. § 482.15).

Long-term care facilities remain subject to an annual emergency-preparedness training requirement. Requirements for other provider and supplier types must be checked under the regulation that applies to that particular organization (Centers for Medicare & Medicaid Services, State Operations Manual: Appendix Z).

Accordingly, healthcare employers should not assume that one universal CMS training schedule applies to every facility. The organization should confirm:

• Its CMS provider or supplier classification.
• The regulation applicable to that classification.
• Initial and recurring training deadlines.
• Exercise and testing obligations.
• Documentation requirements.
• Any additional state, licensing, or accreditation requirements.

Even where CMS permits biennial training, an organization may decide that annual refresher training is appropriate based on employee turnover, facility risk, previous exercise findings, or significant changes to its plan.

What emergency topics should healthcare training cover?

1. Emergency action plan orientation

Every employee should understand the organization’s overall emergency plan and where to find additional information. Training should explain:

• The emergencies addressed by the plan.
• Who has authority to activate emergency procedures.
• Employee roles during an emergency.
• Internal and external reporting methods.
• Evacuation, shelter-in-place, and lockdown decisions.
• How employees receive instructions when normal communication systems are unavailable.

Employees do not need to memorize the entire plan. They do need to know what actions they are expected to take and where to obtain reliable instructions.

2. Fire safety and emergency evacuation

Fire training should address prevention, alarms, smoke and fire response, evacuation, patient assistance, fire doors, medical gas considerations, and the organization’s policy concerning portable fire extinguishers.

Where portable extinguishers are provided for employee use, OSHA requires an educational program explaining the general principles of extinguisher use and the hazards of fighting an incipient-stage fire. This education must be provided upon initial employment and at least annually thereafter. Employees designated to use firefighting equipment as part of the emergency action plan must receive appropriate equipment training when initially assigned and at least annually thereafter (Occupational Safety and Health Administration, “Portable Fire Extinguishers”).

Employees should also understand when not to fight a fire. Evacuation is generally the correct response when the fire is spreading, smoke limits visibility, an appropriate extinguisher is unavailable, or the employee lacks a safe exit behind them.

3. Severe weather and natural disasters

The hazards included in training should reflect the facility’s geographic location and risk assessment. Depending on the location, training may address:

• Hurricanes and tropical storms.
• Tornadoes.
• Flooding and storm surge.
• Wildfires and smoke.
• Earthquakes.
• Extreme heat or cold.
• Winter storms.
• Extended power or water outages.

Employees should know which hazards require evacuation and which require sheltering in a protected interior location. Training should also address staffing, communication, supply shortages, medication storage, generator-dependent equipment, and continuity of patient care.

4. Active shooter and workplace violence response

Workplace violence is a significant concern for healthcare employers. Emergency training should explain how employees report threatening behavior, summon assistance, follow facility alerts, protect patients, and respond during an immediate threat.

Active-shooter and workplace-violence content should be coordinated with the organization’s prevention plan, security procedures, emergency action plan, and applicable state requirements. OSHA recommends addressing active-shooter situations in emergency planning, even though there is not currently one healthcare-specific federal OSHA workplace-violence standard that governs every employer (Occupational Safety and Health Administration, “Workplace Violence”).

Training should be adapted to the healthcare environment. Employees responsible for patients may face different decisions than members of the public, and a generic “run, hide, fight” presentation may not adequately address patient care, secured units, operating rooms, behavioral health settings, pharmacies, or employees working alone.

5. Infectious disease and patient-surge response

Healthcare organizations should prepare employees for infectious disease outbreaks and increased patient volume. Relevant training may include:

• Recognizing and reporting potential infectious cases.
• Triage and screening procedures.
• Hand hygiene and respiratory etiquette.
• Standard and transmission-based precautions.
• Selection, use, removal, and disposal of personal protective equipment.
• Isolation and patient-placement procedures.
• Environmental cleaning and disinfection.
• Exposure reporting and post-exposure procedures.
• Managing shortages of staff, supplies, or patient-care space.
• Communicating changing procedures to employees.

The organization should connect emergency procedures with its infection-prevention policies so employees do not receive conflicting instructions.

6. Bloodborne pathogen exposure response

Employees with occupational exposure to blood or other potentially infectious materials must receive bloodborne pathogens training at initial assignment and at least annually thereafter. Additional training is required when changes in tasks or procedures affect occupational exposure (Occupational Safety and Health Administration, “Bloodborne Pathogens”).

Employees should know what to do immediately after a needlestick, splash, cut, or other exposure. Training should cover washing or flushing the affected area, promptly reporting the incident, obtaining a medical evaluation, and following the facility’s exposure-control plan.

7. Hazardous-material and chemical-spill response

Healthcare workplaces may contain disinfectants, sterilants, laboratory chemicals, compressed gases, hazardous drugs, formaldehyde, and other hazardous substances.

Employees should be trained to:

• Recognize chemical labels and warning signs.
• Locate and use safety data sheets.
• Report a leak, spill, or release.
• Isolate the area when appropriate.
• Avoid attempting a response beyond their training and equipment.
• Use required personal protective equipment.
• Understand evacuation or decontamination procedures.

General hazard communication training does not automatically qualify an employee to perform emergency spill response. Employees assigned specialized response responsibilities may require additional training under other standards.

8. Utility failure and medical-equipment downtime

A power outage, water interruption, heating or cooling failure, medical-gas disruption, or telecommunications outage can quickly become a patient-safety emergency.

Role-specific training should address:

• How to report the failure.
• Which systems are supported by emergency power.
• How to identify and prioritize patients using electricity-dependent equipment.
• Manual or alternate clinical procedures.
• Medication and vaccine temperature controls.
• Emergency water and sanitation procedures.
• Patient relocation or transfer criteria.
• How to communicate if phones, email, or normal alert systems are unavailable.

9. Cyberattack and electronic health record downtime

Cyber incidents should be treated as operational emergencies, not solely as information-technology problems.

The HIPAA Security Rule requires regulated entities to establish a contingency plan for emergencies or other occurrences that damage systems containing electronic protected health information. Required elements include data backup, disaster recovery, and emergency-mode operations. HHS also identifies testing and revising contingency plans and assessing the criticality of applications and data within the contingency-planning standard (U.S. Department of Health and Human Services, “August 2024 OCR Cybersecurity Newsletter”).

Workforce training should explain:

• How to recognize and report a suspected cyber incident.
• When to disconnect or stop using affected equipment.
• How downtime procedures are activated.
• How employees access necessary patient information.
• How paper records are created, protected, and later reconciled.
• How medication, laboratory, imaging, and scheduling processes continue.
• Who may communicate with patients, regulators, vendors, or the media.
• How protected health information remains secure during emergency operations.

10. HIPAA privacy during an emergency

An emergency does not automatically suspend HIPAA. The Privacy Rule continues to protect patient information while allowing disclosures that are necessary for treatment and certain emergency-response purposes (U.S. Department of Health and Human Services, “Emergency Situations”).

Training should help employees understand:

• When information may be shared for treatment.
• How to verify the identity and authority of a requester.
• What minimum-necessary principles may apply.
• How to protect patient information in temporary treatment areas.
• How to handle media or family inquiries.
• Who should make uncertain disclosure decisions.

Employees should not delay urgent treatment because they mistakenly believe HIPAA prevents necessary communication. They also should not assume that every disclosure is permitted simply because an emergency exists.

11. Patient movement, evacuation, and continuity of care

Healthcare evacuation training should account for patient acuity, mobility, life-support needs, medication, transportation, records, family communication, and receiving-facility coordination.

Different employees may need different levels of training:

• General employees may need alarm, evacuation, accountability, and reporting procedures.
• Clinical staff may need patient-prioritization and continuity-of-care procedures.
• Facilities personnel may need utility shutdown and emergency-power responsibilities.
• Security personnel may need access control, traffic management, and law-enforcement coordination.
• Health information personnel may need downtime, patient-tracking, and privacy procedures.
• Leaders may need incident-command, external communication, and transfer-of-authority training.

Training should reflect actual assignments rather than giving every employee the same generic presentation.

12. Incident reporting, recovery, and post-event review

Preparedness continues after the immediate danger has passed. Employees should understand how to:

• Report injuries, exposures, hazards, and patient-safety events.
• Preserve relevant records.
• Participate in debriefings or after-action reviews.
• Access medical or behavioral-health support.
• Resume normal operations safely.
• Complete corrective or refresher training.

After a drill or actual emergency, the organization should identify what worked, what failed, and what needs to change. Corrective actions should be assigned, documented, and incorporated into future training.

How should healthcare employers combine online training and drills?

Online training and practical exercises serve different purposes.

Online training is useful for explaining hazards, procedures, responsibilities, decision-making principles, and regulatory concepts. A learning management system can also document assignments, completion dates, assessment results, and certificates.

Drills and exercises test whether employees can apply that knowledge under facility-specific conditions. They can reveal problems such as:

• Employees who cannot hear or recognize an alarm.
• Blocked or misunderstood evacuation routes.
• Unclear patient-movement responsibilities.
• Outdated call lists.
• Communication systems that fail during an outage.
• Departments that interpret emergency codes differently.
• Supplies or equipment that are unavailable.
• Downtime procedures employees cannot locate or use.

A strong program uses online education to establish foundational understanding and drills, tabletops, simulations, or exercises to practice the organization’s actual procedures. Online training should support—not replace—required exercises and hands-on instruction.

When should emergency preparedness training be provided?

Healthcare organizations should consider training:

• During onboarding or initial assignment.
• At the frequency required by the applicable OSHA, CMS, state, licensing, or accreditation requirement.
• When the emergency plan or employee responsibilities change.
• When new equipment, systems, hazards, or procedures are introduced.
• After an exercise identifies a knowledge or performance gap.
• Following an actual emergency or near miss.
• When an employee transfers to a role with different responsibilities.
• When records, observations, or assessments show that employees cannot demonstrate required knowledge.

September can serve as a practical annual checkpoint even when a particular regulation uses a different compliance schedule.

What emergency-training records should employers maintain?

Training records should make it possible to determine:

• Who received the training.
• What content was covered.
• When the training occurred.
• How it was delivered.
• Whether the learner passed an assessment or demonstrated competency.
• Which facility, department, or role the training addressed.
• Whether retraining or corrective instruction was required.
• Which version of the course or policy was used.

Organizations should also retain drill documentation, attendance records, exercise scenarios, after-action reports, identified deficiencies, and corrective-action records according to applicable requirements and organizational retention policies.

Healthcare emergency preparedness training checklist

During National Preparedness Month, healthcare employers can use the following checklist:

• Review the facility’s all-hazards risk assessment.
• Confirm which OSHA, CMS, state, licensing, and accreditation requirements apply.
• Verify that emergency plans and contact information are current.
• Identify the training required for each workforce role.
• Confirm that employees understand alarms and emergency codes.
• Review evacuation, shelter-in-place, and lockdown procedures.
• Address patients and visitors who require additional assistance.
• Verify fire-safety and extinguisher education requirements.
• Review workplace-violence and active-shooter procedures.
• Confirm infection-control and exposure-response training.
• Test utility, communications, and electronic-record downtime procedures.
• Review HIPAA privacy and security responsibilities during emergencies.
• Assign overdue training and maintain completion records.
• Conduct an appropriate drill, tabletop, or exercise.
• Document deficiencies and assign corrective actions.
• Update training whenever policies or responsibilities change.

Frequently asked questions

Is emergency preparedness training required annually in healthcare?

Not under one universal federal rule. Training frequency depends on the employer, facility type, hazard, employee responsibility, and applicable regulation. For example, OSHA requires annual bloodborne pathogens training for employees with occupational exposure and annual fire-extinguisher education in specified circumstances. CMS requires annual emergency-preparedness training for long-term care facilities, while hospitals generally follow a two-year recurring requirement under the current regulation.

Does OSHA require every employer to have an emergency action plan?

OSHA’s Emergency Action Plan standard applies when another OSHA standard requires a plan. Many employers nevertheless maintain a written emergency action plan as a prudent safety practice. When 29 C.F.R. § 1910.38 applies, the plan must include specified procedures, and affected employees must be informed of their responsibilities.

Can emergency preparedness training be completed online?

Many foundational subjects can be taught online, including emergency-plan responsibilities, fire prevention, evacuation principles, workplace violence awareness, infection control, and emergency communication. Online courses do not replace required drills, exercises, hands-on instruction, or facility-specific training.

Are small physician practices covered by the CMS Emergency Preparedness Rule?

Not every physician practice is independently subject to the CMS Emergency Preparedness Rule. Applicability depends on the organization’s Medicare or Medicaid provider or supplier classification and conditions of participation. Small practices may still have emergency-planning or training obligations under OSHA, state law, licensing rules, contracts, or other requirements.

Does HIPAA still apply during a disaster?

Yes. HIPAA generally remains in effect during an emergency. The Privacy Rule permits important disclosures for treatment and certain emergency-response activities, but an emergency is not a blanket authorization to disclose patient information without limits.

Should healthcare employees receive active-shooter training?

Healthcare employers should evaluate active-shooter and workplace-violence response as part of their hazard assessment and emergency planning. Training should reflect the facility’s layout, security program, patient population, employee responsibilities, and applicable state requirements.

Build a more prepared healthcare workforce

Emergency preparedness depends on employees knowing what to do before a crisis begins. Clear, role-appropriate training can help healthcare workers protect themselves, support patients, maintain essential operations, and respond consistently when normal systems fail.

Evolve e-Learning Solutions offers online healthcare safety and compliance training covering emergency response, fire safety and emergency evacuation, workplace violence prevention, bloodborne pathogens, infection control, personal protective equipment, hazard communication, HIPAA privacy and security, and related subjects.

Organizations can deliver training through Evolve’s learning management system or their own SCORM-compatible LMS. Courses can also be combined into a customized training bundle based on the organization’s workforce, hazards, policies, and compliance needs.

Explore Evolve’s OSHA training for healthcare organizations or request a free course preview to begin building your emergency-preparedness training program.

This article provides general educational information and is not legal or regulatory advice. Requirements may vary by jurisdiction, facility classification, accreditation status, employee responsibilities, and workplace hazards. Organizations should review the laws and standards applicable to their operations.