Emergency Management

Emergency management planning driven by HVAs

A how-to guide on building a clearly documented and up-to-date response for any event

Oct 3, 2025 |

The hazard vulnerability assessment shall use an all-hazards approach and be reviewed annually by the emergency management committee.

Images by Getty Images

In today’s increasingly complex health care environment, emergency preparedness is not optional — it is essential. Hospitals and health care systems must be ready to face a broad spectrum of threats, from natural disasters and pandemics to cyberattacks and utility failures.

To manage these risks effectively, health care facilities must establish a clearly documented and current emergency management program (EMP), grounded in a comprehensive and regularly updated hazard vulnerability assessment (HVA).

A well-structured EMP, informed by the facility’s unique risk profile, enables organizations to anticipate challenges, protect patients and staff, and maintain continuity of care. An HVA-driven approach ensures that emergency planning not only is compliant with regulatory requirements but also tailored to a facility’s specific risks, operational capabilities and community context.

Key EMP elements

Health care facilities professionals can develop an EMP for their organizations by focusing on the following key elements:

Guiding principles. An effective EMP is guided by a set of professional principles. It must be comprehensive, accounting for all hazards and engaging all relevant stakeholders. It should be forward-looking and proactive, anticipating future disasters and building resilience through prevention. A risk-driven approach ensures that priorities and resources are allocated where they are most needed.

Moreover, the program must be integrated across various levels of governance and operational departments, coordinated among all participants and adaptable to changing circumstances. Above all, it should reflect a professional ethos grounded in scientific knowledge, ethical practice, training and a commitment to continuous improvement.

Key phases. An EMP is an all-hazards and multidisciplinary approach that integrates activities across four key phases: Preparedness involves planning, training and exercises that prepare staff and systems for disruptive events; mitigation refers to the actions taken in advance to reduce or eliminate risks to people, property and operations; response encompasses the immediate actions taken during an emergency to manage the event; and recovery includes the efforts to return to normal operations or better.

Click image to expand

In health care, the EMP goes beyond regulatory compliance and serves as a foundational strategy for protecting life, sustaining operations, minimizing property loss and ensuring continuity of care during emergencies.

The EMP consists of program administration, program management, core program elements and annexes. Foundational plans that support the EMP typically include the strategic visioning plan, emergency operations plan (EOP), multi-hazard mitigation plan and the continuity of operations plan (COOP). These documents ensure the program is structured and actionable throughout the emergency management continuum.

Interrelated components. The EMP encompasses four interrelated components: Preparedness involves planning, training and managing resources; mitigation focuses on reducing risk through infrastructure improvements and policy development; response addresses the immediate steps taken during a crisis to protect life and property; and recovery emphasizes restoring systems and services to normal or enhanced functioning following an incident.

For the program to be effective, it must clearly define leadership roles and responsibilities, establish internal and external communication protocols, offer training that aligns with identified hazards and incorporate a structured schedule of drills and exercises. Equally important is maintaining thorough documentation that supports after-action reviews and fosters continuous learning and improvement.

Core components. A successful EMP is characterized by several interrelated elements. The EOP should be comprehensive, with annexes that address specific hazards. Roles and responsibilities must be clearly defined for leadership, clinical and support staffs, and department heads. Communication protocols — internal and external — must be standardized and practiced regularly.

For the program to be effective, it needs to have a well-defined COOP that outlines how the organization will maintain its essential functions during and after disruptions to normal operations. Equally important is maintaining thorough documentation that supports after-action reviews and fosters continuous learning and improvement.

Training is a key component. Staff should receive role-specific training that aligns with the threats identified in the HVA. Exercises and drills must be prioritized based on high-risk scenarios and scheduled regularly. Documentation of these activities, along with lessons learned from after-action reports, form the foundation for continuous improvement and regulatory compliance.

The HVA’s role. The HVA is a strategic tool used to identify, assess and prioritize risks that may impact a health care facility’s ability to operate safely. It is the cornerstone of any effective emergency management strategy, informing all decisions related to planning, mitigation, resource allocation and training.

Click image to view a sample of the ASHE HVA Tool

Resources like the American Society for Health Care Engineering’s HVA Tool can help structure this process. A health care facility will review and revise its EOP based on a current HVA.

The EOP shall include specific procedures to address those events that are found to have the potential to significantly disrupt the provision of care. The HVA shall use an all-hazards approach and be reviewed annually by the emergency management committee (EMC).

The committee will assess whether there are geographic or demographic distinctions between the various facilities within the organization to determine if there are individual, facility-based needs for a separate HVA. If there are no geographic or demographic distinctions noted that influence the HVA, a single HVA will serve for the entirety of the health care organization.

The HVA permits the health system to evaluate the potential for an adverse outcome and reduce the odds of occurrence to a more acceptable level. The risks are assessed based on probability of occurrence; impact to life, property and operations; and mitigation preparation through written response plans, training exercises and facility readiness. The EMC prioritizes risks for the program year and uses the priority risks as the basis of the preparedness program and risk management, including risk mitigation, training and exercises.

An effective hazard assessment can take a significant amount of time, require the best available information and involve many experts to prepare for potential high-probability, high-impact events. The health system determines and sets priorities for likely emergencies, in part through involvement with community entities and review of documents, including county or state office of emergency management, emergency medical services, operational area hazard mitigation plans (community-based risk assessments), hospital emergency preparedness partnerships or other coalitions.

The HVA is communicated to local emergency response agencies. The hospital’s HVA tool evaluates each potential hazard in areas of probability and severity to provide an overall total risk score for each hazard. Listing the hazards in descending order of their total risk scores highlights priority hazards that demand the hospital’s attention, resources and community planning. The hospital’s EMP manual will document mitigation, preparedness, response and recovery protocols developed to address higher-risk events.

Once hazards are evaluated and scored by probability and severity, the resulting risk profile guides how resources are distributed and how operational plans are developed. The EMC then ensures that mitigation strategies, staff training and exercises focus on these high-priority risks.

HVA findings. The true value of the HVA lies in how well its findings are integrated into planning, training and resource allocation. Too often, the HVA becomes a compliance checklist rather than a strategic document. To avoid this, hospitals should use the HVA as a central guide for tailoring EOPs to address top-priority risks.

For example, if a facility is in an area prone to wildfires, emergency plans should account for air filtration needs, evacuation protocols and regional coordination. Training exercises should simulate likely scenarios — such as a power outage, active shooter event or cyberattack — and budget planning should align with risk mitigation needs, such as investing in generators or water reserves.

As threats evolve, policies and procedures should be updated to reflect new vulnerabilities. Effective EMPs also involve strong community partnerships with public health, law enforcement and emergency services agencies to ensure a coordinated response during regional events.

Regulatory requirements. Federal and accrediting agencies have established clear expectations for emergency preparedness. The Centers for Medicare & Medicaid Services emergency preparedness rule requires health care facilities to conduct both facility- and community-based HVAs, develop an all-hazards emergency plan and coordinate planning with local emergency agencies.

Similarly, Joint Commission mandates annual reviews of the HVA and expects health care organizations to align their EOPs with current hazard assessments. Leadership involvement and clear documentation showing how HVA findings inform preparedness activities are key to maintaining compliance.

Meeting these requirements involves more than checking boxes. Health care facilities must demonstrate that their EMPs are responsive to the identified risks and supported by appropriate documentation, planning and training. Facilities that treat the HVA as a living document rather than a static requirement are better positioned to respond effectively during actual emergencies.

Implementing best practices. Sustaining an effective EMP is a continuous process. Regular reviews of the HVA, training updates, community engagement and feedback from exercises all contribute to improvement. The EMC should meet regularly to evaluate current threats and revise plans accordingly.

Staff training is another pillar of sustainability. Employees at all levels must understand their roles and responsibilities during an emergency. Exercises and drills — especially those based on real scenarios and top-priority risks — help reinforce this knowledge.

Community collaboration enhances systemwide readiness. Partnerships with public health departments, emergency medical services, law enforcement and health care coalitions help build a networked response that can be activated during large-scale emergencies. After-action reviews following drills and real incidents provide invaluable insights for refining both the EMP and the HVA.

Documentation plays a critical role. Records of training sessions, committee meetings, exercises and plan updates are essential for demonstrating compliance and for institutional learning. Continuous quality improvement efforts should be based on documented observations and data.

A strategic compass

A well-documented and actively maintained EMP, guided by a thoughtful and comprehensive HVA, is the foundation of resilience in health care. Aligning planning, training and resource allocation with the actual risks faced by the organization enables health care leaders to respond effectively to crises and maintain continuity of care.

By integrating HVA findings into emergency operations, staff training, budgeting and resource allocation, organizations can transform emergency preparedness from a compliance activity into a strategic priority. When used effectively, the HVA is a powerful tool that aligns institutional readiness with the actual threats a facility may face.

In an era defined by uncertainty, a proactive, integrated and risk-informed approach to emergency management is not just recommended but vital. The HVA is not simply a planning requirement; it is a strategic compass guiding organizations toward greater preparedness, responsiveness and resilience.

HVA tools and resources

Selecting the right tool for your health care facility depends on your facility’s size, location and regulatory environment. Here are a few commonly used hazard vulnerability assessment (HVA) resources:

The American Society for Health Care Engineering’s HVA Tool. This tool can be used to assist a multidisciplinary group in assessing and prioritizing exercises for potential hazards and risks. The tool helps facilities develop the required documentation for accrediting organizations and compliance with the Centers for Medicare & Medicaid Services’ Conditions of Participation. The Excel-based HVA tool scores emergency preparedness using the all-hazards approach and identifies the potential hazards that need the most attention.
The California Emergency Medical Services Authority’s HVA resources. This group provides community-based HVA tools tailored to medical-health systems, including risk assessment templates.
The Federal Emergency Management Agency’s Threat and Hazard Identification and Risk Assessment. This is designed for communitywide risk assessment but adaptable for larger health care systems.