Last verified: September 2026
The CMS Emergency Preparedness Rule exercise requirement, explained
What the CMS Emergency Preparedness Rule requires for testing exercises — who it covers, the inpatient and outpatient cadences, what surveyors ask for, and where the rule is deliberately silent.
CMS Emergency Preparedness
If you participate in Medicare or Medicaid, your exercise program is a Condition of Participation. A surveyor will ask for it, and what they expect depends on what kind of provider you are.
What follows is what the rule actually says, by provider type, with the parts that summaries most often get wrong. Everything here is sourced to CMS's own interpretive guidance — Appendix Z of the State Operations Manual — and cited in the footnotes.¹
Who this applies to
Appendix Z covers seventeen provider and supplier types, each with its own Condition of Participation: hospitals, critical access hospitals, psychiatric residential treatment facilities, ambulatory surgical centers, hospices, long-term care facilities, home health agencies, rural health clinics and FQHCs, community mental health centers, ESRD facilities, organ procurement organizations, PACE organizations, transplant programs, and others.¹
That breadth is why the rule matters so much to this audience. It is also where the first mistake happens: breadth of scope is not uniformity of requirement. A hospital and a rural health clinic are both covered, and they are not held to the same cadence.
Requirements at a glance
| Requirement | Citation | Cadence | Evidence to keep |
|---|---|---|---|
| Test the emergency plan — inpatient (hospitals, CAHs, PRTFs) | §482.15(d)(2), §485.625(d)(2), §441.184(d)(2) | Twice per year, every year | Documentation of both exercises |
| Test the emergency plan — outpatient (ASCs, RHCs/FQHCs, CORFs, CMHCs, ESRD, OPOs, RNHCIs) | §416.54(d)(2), §491.12(d)(2), and parallel provisions | Annually, with full-scale every 2 years | Documentation across the full 2-year cycle |
| Full-scale exercise | §482.15(d)(2)(i) and parallel | Annual (inpatient) / every 2 years (outpatient) | Community-based participation, or evidence it was unavailable |
| Second exercise — may be a tabletop | §482.15(d)(2)(ii)(C) and parallel | Annual (inpatient) / opposite year (outpatient) | Scenario used, participants, facilitator |
| Analyze response, document, revise the plan | §482.15(d)(2)(iii) and parallel | Every exercise and every real activation | Analysis, resulting plan revisions |
| Retention | Appendix Z survey guidance | Recommended: 2 years inpatient, 4 years outpatient | Whatever the surveyor's review cycle reaches |
Citations are to the Conditions of Participation as reproduced in Appendix Z.¹
The part people get wrong: "alternating years" is not universal
You will read, often, that CMS requires an annual exercise and that a tabletop is the "exercise of choice" in alternating years. That describes outpatient providers. It does not describe a hospital.
Inpatient providers — hospitals, CAHs, PRTFs — test twice per year, every year. The rule requires an annual full-scale community-based exercise (or, where a community-based exercise is not accessible, an annual facility-based functional exercise), plus an additional annual exercise.¹ Nothing alternates. Both happen, every year.
Outpatient providers test annually, with the full-scale exercise every two years and the additional exercise in the opposite year.¹ This is where the alternating pattern lives.
The second distinction worth getting right: the rule does not anoint the tabletop. It says the additional exercise "may include, but is not limited to" three options — a second full-scale or facility-based functional exercise, a mock disaster drill, or a tabletop exercise or workshop.¹ A tabletop qualifies. It is not the designated alternate.
What the rule means by "tabletop"
This is the sentence worth reading closely, because it is unusually specific about what has to happen in the room. The rule permits:
"A tabletop exercise or workshop that is led by a facilitator and includes a group discussion, using a narrated, clinically-relevant emergency scenario, and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan."¹
Four things are load-bearing there: a facilitator, a narrated scenario, that scenario being clinically relevant to your facility, and prepared material designed to challenge the plan rather than confirm it. A discussion that walks through the binder and agrees with it does not meet the description.
What surveyors look for
Surveyors work from documentation, and Appendix Z's survey procedures ask for a consistent set of things: the exercises themselves, evidence of community-based participation or a documented account of why it was not available — dates, personnel, agencies contacted, reasons — and the facility's analysis of its own response, along with the plan revisions that followed.¹
That last item is the one that fails most quietly. The rule does not stop at "conduct an exercise." It requires that you **analyze the response, maintain documentation, and revise the emergency plan as needed.**¹ An exercise with a sign-in sheet and no analysis clears the first half of a requirement whose second half is where the value is.
On retention: CMS recommends — it does not mandate — keeping at least two years of documentation for inpatient providers and at least four for outpatient providers, because surveyors review on that cycle.¹ Three years is a number that appears in a great many summaries and nowhere in Appendix Z.
Where the rule is deliberately silent
Naming these matters more than papering over them, because a surveyor may read them differently than you do.
- Who facilitates is undefined, on purpose. CMS states plainly that it is "not defining whether or not the facilitator must be a staff member or contracted service," noting that a department lead may suit some scenarios and an outside facilitator others.¹ An in-house facilitator is explicitly acceptable.
- "Not accessible" is not quantified. There is no threshold for when a community-based exercise counts as unavailable, and no defined standard for how much effort you must document having made.¹
- No CMS sign-off exists — but your state may require one. CMS does not require approval or official sign-off of the emergency program, and recommends checking with state agencies and local emergency planning coordinators, as some states require approval under licensure.¹
- Full-scale exercises have no minimum participant count. CMS recommends at minimum the involvement of local or state emergency officials, but sets no specific number.¹
Getting more from the exercises you're required to run
The exercises are mandatory, and the cadence is fixed. What the rule asks you to do afterwards is where the value is: analyze your response, maintain documentation, and revise the emergency plan as needed.¹ That duty can only work with what the exercise surfaces.
An exercise that confirms the plan gives the analysis nothing to work on. The rule's own description of a tabletop calls for material "designed to challenge an emergency plan."¹ A scenario that adapts to what the room decides keeps challenging it: when the first response holds, the next inject tests the one after it. That is one of the most direct ways to find the gaps your analysis and plan revisions exist to close.
"Clinically relevant" is the rule's phrase, and good craft besides. A scenario built on the disruptions your facility actually faces puts the plan under the pressure it will meet, not the pressure that is easiest to stage.
What Crewcible produces that maps to it
Crewcible is built for the exercise itself — designing it, running it, and capturing what came out of it. Three outputs line up against what a surveyor asks for.
The exercise. Global Library scenarios are facilitator-led and built on narrated, clinically relevant disruption, which is the shape the rule describes — that is what the Library holds and what the facilitator command center runs. They are designed to support the requirements on this page.
The record. The rule does not stop at conducting an exercise — it requires that you analyze the response, maintain documentation, and revise the plan as needed.¹ Crewcible captures decisions and reasoning per participant and per inject as the exercise runs, so what you retain is a record rather than a recollection written up a week later.
The improvement plan. After-action output comes out of the exercise rather than being reconstructed after it, which is the half of the requirement that most often goes thin.
The facilitator decides what gets released and when, so the judgment stays where the rule assumes it is: with your people. AI enabled, human led.
Crewcible is built by experts who have supported crisis situations and exercises in the world's largest organizations.
For a ready-to-run healthcare starting point, see Clearinghouse Down: The Claims and Payments Blackout in the Global Library.
Regulatory references current as of September 2026. This guide is scheduled for re-verification by March 2027.
¹ Centers for Medicare & Medicaid Services, State Operations Manual, Appendix Z — Emergency Preparedness for All Provider and Certified Supplier Types, Interpretive Guidance (Rev. 204, issued 2021-04-16). Appendix Z reproduces the Conditions of Participation text for each provider type alongside CMS's interpretive and survey guidance; all regulatory language quoted above is taken from it.