Skip Navigation U.S. Department of Health and Human Services
Agency for Healthcare Research Quality
Archive print banner
Reopening Shuttered Hospitals to Expand Surge Capacity

Public Health Emergency Preparedness

This resource was part of AHRQ's Public Health Emergency Preparedness program, which was discontinued on June 30, 2011, in a realignment of Federal efforts.

This information is for reference purposes only. It was current when produced and may now be outdated. Archive material is no longer maintained, and some links may not work. Persons with disabilities having difficulty accessing this information should contact us at: Let us know the nature of the problem, the Web address of what you want, and your contact information.

Please go to for current information.

Appendix D. Legal & Regulatory Issues (continued)

Chapter 2.  Federal Laws and Regulations

The Federal regulatory and statutory requirements for hospitals are extensive. The Code of Federal Regulations (CFR) contains requirements for hospital administration, services, staffing, patient rights, patient transport, and record keeping. Many of these regulations are contained in the part of the CFR devoted to the Medicare conditions of participation (COPs) for hospitals. These standards must be met for a hospital to participate in the Medicare program (i.e., receive payment for services furnished to Medicare beneficiaries). While a surge hospital would likely count Medicare beneficiaries among its patients, some of the standards required of Medicare participating hospitals are not appropriate for the circumstances under which a surge facility would be operating. In order for a surge facility to operate within the boundaries of the law and serve its intended purpose, these requirements would need to be waived by the Federal government in advance of an emergency. 

This chapter describes the Federal standards for the operation of acute-care hospitals and identifies requirements that could not be met by a former/shuttered hospital operating in a surge capacity.  

2.1 Administration

Federal rules concerning the administration of hospitals are found in the CFR under the Medicare program's conditions of participation.1 The CFR addresses the following Federal requirements regarding the administration of hospitals:

  • Compliance with Federal, State, and Local Laws.
  • Governing Body.
  • Quality Assessment and Improvement Program.
  • Survey and Certification.

As noted above, the Federal government provides general guidance on the operation of hospitals while State and local laws include more specific requirements.

Compliance with Federal, State and Local Laws

"The hospital must be in compliance with applicable Federal laws related to the health and safety of patients." The hospital must be licensed or approved for meeting State and local standards and ensure that its personnel are licensed or meet the requirements of applicable State or local laws. 

State and local laws may address hospital licensure, accreditation of personnel, environmental hazards, and emergency response systems. State and local laws and their applicability to surge facilities are addressed in Section 3.0 of this report. 

Governing Body

"The hospital must have an effective governing body legally responsible for the conduct of the hospital as an institution or the persons legally responsible for the conduct of the hospital must carry out the functions of the governing body related to medical staff, chief executive officer, care of patients, institutional plan and budget, and contracted services." 

One of the primary questions regarding the conversion of a former hospital into a surge facility is 'who would be responsible for its operation?' A currently functioning acute-care hospital or health-care system would be a likely entity to assume responsibility for a surge facility, given that it has systems and experience in overseeing all aspects of hospital operations. The Board or other governing body of the overseeing hospital or health-care system would be responsible for ensuring that Federal, State and local requirements are met at the surge facility. Because the activities of a surge facility would be more limited and perhaps different from those of an ordinary hospital, the procedures and policies of the surge facility would likely be separate from those of the overseeing hospital. The governing Board of the overseeing hospital would need to develop the policies and procedures for the surge facility prior to a disaster.

Another option would be for the State or county health department to assume responsibility for the surge facility, which would be necessary if there were no existing hospital or health-care system willing/able to step in. In this case, none of these boards, procedures or policies would exist and all would need to be created in advance of a mass casualty event, in order to implement a surge facility plan.

Quality Assessment and Performance Improvement Program

"The hospital must develop and implement an effective, ongoing, hospital-wide, data-driven quality assessment and performance improvement program." Quality assessment and performance improvement plans include protocols for patient care that are continuously evaluated and amended to improve outcomes and other measures of quality. 

The particular circumstances of a surge facility make quality assessment and performance improvement programs impractical to implement. Data collection and analysis, as well as process improvements would be difficult to perform on the temporary basis in which a surge facility operates. At the same time, a quality assessment and performance program would allow the entity overseeing the surge facility to learn from its disaster experience so that it could provide better care in future surge situations. An assessment and improvement program could be developed to address basic issues prior to the operation of a surge facility. Such a plan would require the collection of basic data from the surge facility. From a practical standpoint, the data could be analyzed at the conclusion of the emergency rather than on an ongoing basis. The surge facilities' quality protocols could be modified once the emergency situation has abated. 

Recommendation: Some requirements, like quality assessment programs, cannot be met at a temporary/emergency surge facility, and would need to be waived.

Return to Appendix D Contents

2.2 Services

The Medicare hospital conditions of participation also provide standards for services furnished in acute-care facilities. The COPs define and provide standards for "basic services," those that must be provided by a Medicare participating hospital. In addition, these regulations provide standards for optional services. 

As defined in Section 1.2 of this report, a surge facility would not provide all of the basic services required by Federal regulations. Standards would need to be revised or requirements waived in order for surge facilities to comply.  This might also be true of existing hospitals that are not be able to comply with current standards in a large-scale mass casualty situation.

Recommendation: Medicare COPs would need to be reduced/waived for a temporary/limited service surge facility.

Return to Appendix D Contents

2.2.1 Basic Services

This section identifies services hospitals must provide in order to be in compliance with the Medicare conditions of participation. Most of these services would be provided by a surge hospital during scenarios described in Chapter 1 of this report.

Pharmaceutical Services

"The hospital must have pharmaceutical services that meet the needs of the patients. The institution must have a pharmacy directed by a registered pharmacist or a drug storage area under competent supervision. The medical staff is responsible for developing policies and procedures that minimize drug errors. This function may be delegated to the hospital's organized pharmaceutical service."

The CFR provides further definitions of the Federal standards for pharmacy management and administration, and delivery of pharmacy services including but not limited to storage of pharmaceuticals and biologics, reporting of errors and adverse reactions, and formulary development. 

We expect that the surge facility will provide pharmacy services. The regulations for pharmacy services are broad and would not necessarily need to be changed for a surge facility.  If the surge facility were to have a stock of "basic" pharmaceuticals needed for opening, these drugs and biologicals could be supplemented as needed. One option might be to have a nearby tertiary hospital serve as the main pharmacy, supplying the surge facility and managing inventory/ordering. This would require a revision to the regulations as the surge pharmacy would not, by itself, meet the needs of its patients. If no nearby hospital can/will fill this role, the surge facility will be on its own, and waivers may need to be even more extensive. 

Radiologic Services

"The hospital must maintain, or have available, diagnostic radiologic services. If therapeutic services are also provided, they, as well as the diagnostic services, must meet professionally approved standards for safety and personnel qualifications." 

If the surge facility does not have operational radiology services already in place, portable diagnostic radiology equipment, supplies and staff will need to be brought into the facility.  Patients needing therapeutic radiology services such as chemotherapy would be treated in a tertiary care hospital, not in the surge facility.

Laboratory Services

"The hospital must maintain, or have available, adequate laboratory services to meet the needs of its patients. The hospital must ensure that all laboratory services provided to its patients are performed in a facility that is certified."

We expect a formerly shuttered hospital might be lacking modern equipment and would not be operational without significant investment of time and effort. Rather than create an on-site clinical laboratory, it would be more practical to use bedside point of care testing for routine tests and contract with a private laboratory testing company accessed by courier for more advanced tests. It does not appear that these regulations would pose a problem or need to be adapted, to permit this approach.

Food and Dietetic Services

"The hospital must have organized dietary services that are directed and staffed by adequately qualified personnel." The CFR allows the hospital to contract these services with an outside food management company if the company has a dietitian and consults with the medical staff.

Former hospitals with intact kitchens would be able to provide food services to patients, with the oversight of a hospital dietitian to design special diets for patients with restrictions. It is unlikely that a hospital without a functional kitchen, however, would be able to meet this standard. Obtaining food and dietetic services from an outside vendor is a possibility and vendors we contacted indicated that they could absorb the increased demand of a temporary facility housing upwards of 200 patients. 

Utilization Review

The CFR requires that hospitals have a plan in place to review services provided by the institution and medical staff, either internally or by a Quality Improvement Organization. It would be impractical for a surge facility to conduct utilization review either directly or by another entity. The data set examined would be small due to the short time-frame the facility would be open, and it would be difficult to determine appropriateness of services given the unusual circumstances under which the surge facility would be operating. This requirement would need to be waived for a surge facility in a mass casualty event.

Physical Environment

"The hospital must be constructed, arranged, and maintained to ensure the safety of the patient, and to provide facilities for diagnosis and treatment for special hospital services appropriate to the needs of the community." From a practical standpoint, any former hospital that would be considered a surge facility would need to comply with this requirement.  Legally, a facility could be at great risk if its physical environment was not safe for patients or suitable for providing the care needed for the scenarios described earlier.2

Infection Control

"The hospital must provide a sanitary environment to avoid sources and transmission of infections and communicable diseases. There must be an active program for the prevention, control, and investigation of infectious and communicable diseases." The regulations provide more detail on the responsibilities of personnel with regard to infection control and reporting. To be effective, an infection control program would need to be established prior to the opening of the surge facility. If the hospital is operated by a nearby acute-care hospital, the plan could be modeled on that of the oversight hospital. If not, the State would have to design such a program, in advance, appropriate for either Scenario 1 (general ambulatory med/surg patients) or Scenario 2 (infectious patients). We do not believe this requirement can or should be waived.

Discharge Planning

"The hospital must have in effect a discharge planning process that applies to all patients. The hospital's policies and procedures must be specified in writing." The CFR also specifies the process of identifying patients in particular need of discharge planning, conducting a discharge planning evaluation, and requirements of the plan. 

In the case of a mass casualty event, acute care hospitals would need to simplify or modify their discharge planning process so that patients could be quickly discharged to skilled nursing facilities, rehab facilities, a surge facility, or home, as appropriate. All hospitals might need to have the authority to use an alternative discharge plan in the case of a disaster.  The plans would need to be developed prior to an actual disaster. Similarly, a surge facility could comply with the requirement to have a discharge plan as long as the process was designed in advance of a mass casualty event. Such a plan could be modeled on that of an existing facility, modified as needed to fit the particular circumstances of the disaster situation. That is, if a major trauma center has a plan for revising discharge processes, planners for the surge facility could adopt and modify that plan for their own purposes. For either existing hospitals or a surge facility, discharge planning requirements may need to be waived in a mass casualty situation, so that patients can be quickly moved to the most appropriate setting of care while serving the needs of large numbers of acutely ill or injured patients.

Organ, Tissue, and Eye Procurement

The CFR requires hospitals to have agreements with organ procurement organizations (OPOs) for the identification and harvesting of organs for transplant. Given that a surge facility would not be providing sophisticated levels of care and would not have an operating room, it is unlikely that it would be able to provide the level of care required for the safe harvesting of organs. A surge facility would not be able to meet the requirements of an organ procurement agreement. While continuously operating hospitals would have agreements with OPOs, they too may have difficulty meeting such obligations in a disaster situation. Federal regulations and provisions of contracts between hospitals and OPOs should probably be suspended for all hospitals during a mass-casualty event, and would need to be waived entirely for a surge facility. 

Return to Appendix D Contents

2.2.2 Emergency Services

The Emergency Medical Treatment and Labor Act (EMTALA) was passed in 1986 in response to reports that hospital emergency rooms were refusing to accept or treat individuals with emergency conditions if the individual did not have insurance.3 The law defines the obligation of Medicare-participating hospitals with respect to persons who come to a hospital emergency department and request examination or treatment for medical conditions. In addition, EMTALA sets forth requirements for performing a medical screening, providing stabilizing services, and appropriate transfer of the patient. In addition, the Act sets forth civil monetary penalties on hospitals and physicians for:

  1. Failing to properly screen an individual seeking medical care.
  2. Negligently failing to provide stabilizing treatment to an individual with an emergency medical condition.
  3. Negligently transferring or releasing from care an individual with an emergency medical condition.4

These penalties for inappropriate transfer during a national emergency do not apply to a hospital operating in an emergency area.5

The regulations define hospitals' responsibilities with respect to EMTALA as follows:

  • When an individual presents to a hospital's emergency department and a request is made on the individual's behalf for examination or treatment of a medical condition, the hospital must provide for an appropriate medical screening examination to determine whether or not an emergency medical condition exists.
  • If the hospital determines that an emergency medical condition exists, the hospital must provide for further medical examination and treatment in order to stabilize the individual.
  • If the hospital does not have the capabilities to stabilize the individual a transfer to another facility is permitted.
  • A transfer is appropriate when the benefits of the transfer outweigh the medical risks of the transfer.
  • In addition, a hospital may transfer an unstable patient who makes an informed written request.

As yet there has been no guidance that permits waiver of EMTALA, even in a mass casualty event or Federally-declared disaster. We reviewed the EMTALA regulations for their applicability to surge facilities and other hospitals operating in a mass casualty situation.6 The regulations broadly define a hospital emergency department as "a specially equipped and staffed area of the hospital that is used a significant portion of time for the initial evaluation and treatment of outpatients for emergency medical conditions." The definition encompasses not only what is generally thought of as a hospital's emergency department but also includes other departments of hospitals, such as labor and obstetrical delivery departments and psychiatric units of hospitals, if these departments provide emergency services. In addition, the definition includes other departments of the hospital that are presented to the public as an appropriate place to come for medical services on an urgent, non-appointment basis.

Recommendation: Elements of EMTALA would also need to be reduced/waived for a temporary/limited service surge facility. Ex: the benefits of transfer to a surge facility would be to make room for other patients needing tertiary hospital services, not necessarily for the benefit of the transferred patient. Ex: patients would not necessarily be asked to consent to transfer to the surge facility.

In a disaster scenario, it is likely that many people will present at trauma centers and community hospitals seeking medical evaluation and or treatment. An extremely large volume of people seeking evaluation would pose challenges for any hospital. Trauma centers and tertiary care hospitals—entities that provide emergency medical services and present so to the public—are bound by the EMTALA regulations and would have to assess the condition of each patient to determine whether or not s/he was in an emergency situation and provide stabilizing treatment to those who need it. As the regulations provide for the transfer of patients who are unstable, with their written consent, the hospital could transfer an unstable patient to another facility before conducting an evaluation, but only if the patient consented. Otherwise the hospital would need to provide an examination to determine whether or not the person was in an emergent situation and provide stabilizing care as needed.

The surge facility we envision would not meet EMTALA's broad definition of a hospital with an emergency department, as they would not have provided these services in several years and would not present themselves to the public as a provider of emergency medical services. As envisioned here, a surge facility would provide services to patients that had been transferred to it, from a trauma center or tertiary care hospital. The surge facility's unique situation would make it unlikely that individuals would go to the facility seeking treatment because people in community would not think of it as a usual source of care or a source of emergency. Anyone who did present to the surge facility could be redirected to one of the fully-functional hospitals in the area. Should someone present seeking a medical evaluation, it is not clear whether or not  EMTALA's rules for screening and providing stabilization care would apply to a surge facility.  Guidance should be obtained from the Federal government regarding the applicability of EMTALA to a surge facility.

Hospitals are concerned about the implications of EMTALA in disaster situations. The Joint Commission on Accreditation of Healthcare Organizations (JCAHO), the accrediting body for 80 percent of the nation's hospitals, believes the Department of Health and Human Services should provide clarification on the application of EMTALA during disaster situations. Such clarification would assist communities in their disaster preparedness activities.7  If such clarification is forthcoming, we recommend that it also address:

  • What constitutes a disaster that obviates EMTALA requirements (if any), and who can declare such a disaster—only the President?
  • Which EMTALA requirements can be 'lifted' (partially or entirely) for various potential types of disasters? For how long?
  • Is there a scaled-down set of EMTALA requirements that might apply to a surge facility during a mass casualty event?
  • At what point would the EMTALA requirements be reapplied—when would they go back into effect following a mass casualty event?
  • Could the monetary penalties be enforced—or could they be suspended—during/following a mass-casualty event?
Recommendation: Federal officials should specifically address EMTALA-related issues, rather than waiting for a mass casualty "test case".

Return to Appendix D Contents

2.2.3 Optional Services

The CFR also lays out standards for a number of optional services that may be offered by regular hospitals: 

  • Surgical services.
  • Anesthesia services.
  • Nuclear medicine.
  • Outpatient services.
  • Rehabilitation services.
  • Respiratory care services.

These services would likely be provided by any acute care hospital to which trauma casualties would be sent. Fulfilling the Federal requirements during an emergency should not pose a problem for those hospitals already providing the "optional" services, but they might want to reduce attention to these optional services during the mass casualty event. For the scenarios and patient populations considered here, none of these services would be provided by a surge facility. 

Return to Appendix D Contents

2.3 Staffing

2.3.1 Hospital Staffing

The Code of Federal Regulations COPS contains regulations covering various services. Based on our assumed patient population and their needs, we reviewed the regulations related to staffing. Most regulations are not specific, requiring only that staff be qualified and in numbers sufficient to meet the needs of the patients. Requirements for the following services were reviewed:8

  • Medical Staff. The medical staff must be composed of doctors of medicine or osteopathy.
  • Nursing Services. "The director of nursing services must be a licensed registered nurse. He or she is responsible for... determining the types and numbers of nursing personnel and staff necessary to provide nursing care for all areas of the hospital. There must be adequate numbers of registered nurses, licensed nurses and other personnel to provide nursing care to all patients as needed. There must be supervisory and staff personnel for each department or nursing unit to ensure, when needed, the immediate availability of a registered nurse for bedside care of any patient."
  • Medical Records. "Must be appropriate to the scope and complexity of services performed. The hospital must employ adequate personnel to ensure prompt completion, filing and retrieval of records."
  • Pharmaceutical Services. "A full-time, part-time or consulting pharmacist must be responsible for... all the activities of the pharmacy services. The pharmaceutical service must have an adequate number of personnel to ensure quality pharmaceutical services, including emergency services."
  • Radiologic Services. A qualified full-time, part-time or consulting radiologist must supervise the ionizing radiology services. A radiologist is a doctor of medicine or osteopathy who is qualified by education and experience in radiology.
  • Laboratory Services. The hospital must maintain or have available (either directly or through a contractual agreement), adequate laboratory services to need the needs of its patients.
  • Food and Dietetic Services. The hospital must have a full-time employee who services as director of the food and dietetic service and there must be a qualified dietitian full-time, part-time or on a consultant basis and administrative and technical personnel competent in their respective duties.

Return to Appendix D Contents

2.3.2 Long-term Care Staffing

Federal requirements for staffing in long-term care facilities are similar to those for hospitals, with additional provisions for ensuring that services not available on site are available contractually, e.g., laboratory, radiology and pharmacy. The surge facility may contain patients that more resemble nursing-facility and rehab patients, rather than tertiary care patients. Long-term care staffing ratios may therefore be more appropriate for a surge facility (at least under Scenario 1).

  • Nursing. Long-term care regulations are specific that there must be a registered nurse in the facility 8 consecutive hours 7 days a week and that there must be "sufficient nursing staff to provide nursing and related services to attain or maintain the highest practicable physical, mental and psychosocial well-being of each resident..."9 The surge facility would most assuredly have nursing capacity beyond this minimum.
  • Dietary. The facility must employ a qualified dietitian either full-time, part-time or on a consultant basis. If a qualified dietitian is not employed full-time, the facility must designate a person to serve as the director of food service who receives frequently scheduled consultation from a qualified dietitian.10 A qualified dietitian is one who is qualified based upon either registration by the Commission on Dietetic Registration of the American Dietetic Association, or on the basis of education, training or experience in identification of dietary needs, planning and implementation of dietary programs.11 This would be needed at the surge facility as well and might be available through a food service vendor.
  • Social Services. A facility with more than 120 beds must employ a qualified social worker on a full-time basis—a bachelor's degree in social work or a bachelor's degree in a human services field including but not limited to sociology, special ed, rehab counseling and psychology, and 1 year of supervised social work experience in a health-care setting working directly with individuals.12 This might be possible in a surge facility during a mass casualty event, but we suspect that a surge facility would not be able to provide a full range of social services, so this requirement might need to be waived.

Return to Appendix D Contents

2.4 Patient Rights

The Medicare conditions of participation for hospitals include standards to "protect and promote the rights of each patient." We identified and reviewed the following issues related to patient rights.13

Notice of Rights

A hospital is required to inform each patient or his/her representative of the patient's rights, in advance of furnishing or discontinuing patient care whenever possible.  A hospital must notify patients whom to contact to file a grievance and establish a process for the prompt resolution of all grievances. In addition, the following standards for patient rights are also addressed by the conditions of participation. We see no reason that this standard would need to be reduced or waived for a surge facility (or any other hospital) operating during a mass casualty event. 

Exercise of Rights

The patient has the right to participate in the development of his/her plan of care, may request or refuse care, develop advance directives, and have a representative be notified of his/her admission to the hospital. This too appears to be acceptable for a surge facility.

Confidentiality of Patient Records

The patient has the right to confidentiality of his or her clinical records and the right to access information contained in his/her medical record within a reasonable time. There is no need to waive or reduce this requirement.

Restraint for Acute Medical and Surgical Care

"The patient has the right to be free from restraints of any form that are not medically necessary or are used as a means of coercion, discipline, convenience, or retaliation by staff." There is no need to waive or reduce this requirement.

Seclusion and Restraint for Behavior Management

"The patient has the right to be free from seclusion and restraints, of any form, imposed as a means of coercion, discipline, convenience, or retaliation by staff." There is no need to waive or reduce this requirement.

As part of the Medicare prospective payment system for hospitals, patients have the right to appeal a planned discharge from the hospital.14 Under these regulations a patient cannot be discharged while awaiting the appeal decision.  This process can take a few days. In the case of a mass casualty event, moving patients quickly from a tertiary hospital to another facility, a surge facility, or home would be critical to meeting increased demand for hospital services. The discharge appeal right outlined in the hospital prospective payment system regulations would probably need to be waived. 

The Federal regulations do not provide additional guidance with respect to patient's right to choose the hospital at which he or she is treated, or to which s/he is transferred, however, some States' regulations provide patients with these rights.

Return to Appendix D Contents

2.5 Transport

The CFR outlines general requirements for ambulance providers and suppliers in transporting Medicare beneficiaries. Section §410.41 of 42 CFR describes the requirements of a vehicle operating as an ambulance and the requirements of ambulance staff and their training/certification. Medicare payment rules, which were not examined as part of this study, provide additional clarification on the types of vehicles and level of services provided by ambulances, for which Medicare will reimburse. More detailed rules exist at the State level and are described in Chapter 3.

Return to Appendix D Contents

2.6 Patient Information and Privacy Standards

Patient information and privacy of health information are addressed in the regulations pertaining to the Medicare conditions of participation for hospitals and the Health Insurance Portability and Accessibility Act of 1996 (HIPAA).  This section describes the standards provided in these two sets of regulations.15

The COPS requires that hospitals have a medical record service that maintains patient records for every patient in the hospital and that allows for easy and timely retrieval of patient records.16 The regulations relate to the organization and staffing of the medical record service, the form and retention of the medical record, as well as the content of the record.

Organization and Staffing

"The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records." Maintaining and staffing a medical record service should not pose a problem for a surge facility, assuming adequate advance planning. Our accompanying report includes an organizational chart for a surge facility during a mass casualty event; in this schematic, the patient information officer would be responsible for the patient record systems. If the surge facility were to be operated by an existing hospital, policies and procedures from its hospital record service could be modified so that a record service for the surge facility could be put in place very quickly. If the surge facility is to be operated by the State, more extensive advance planning may be needed.

Form and Retention of Record

"The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentication and protects the security of all record entries." The regulations also contain specific requirements concerning the content of the medical record for hospital inpatient stays. The hospital must have an indexing system for timely retrieval of records by diagnosis. The regulations further stipulate that medical records must be retained in their original or legally produced form for a period of at least 5 years. In addition, the hospital must have a procedure to ensure the confidentiality of records.

These requirements may be possible to meet, at least in part, at a surge facility, during a mass casualty event. It would not be practical, however, to produce a medical record as detailed as that required in a regular hospital environment, given the urgency of transferring and treating patients in a disaster situation.

A sophisticated indexing system—such as one that would allow the retrieval of documents by diagnosis—would be unnecessary in a surge facility. The main purpose of an indexing system is to facilitate utilization review and quality improvement studies. Because these functions would not be required of surge facilities, the system is not needed. In addition, the number of patient records generated by a surge facility would be relatively small, assuming the facility would be open for no more than 60 days. These files could be accessed and used for patient care purposes without a sophisticated indexing system.

The requirement that hospitals retain records for 5 years could be problematic for a surge facility. Because a surge hospital is designed for temporary use and will revert back to its previous (unoccupied) state at the end of the emergency, it may be impractical to store the records at the facility where conditions are sub-optimal and privacy would be hard to ensure.  One alternative would be to merge the records back into the records of the tertiary hospital from which each patient was transferred. Or the records could be stored by the State health department, or by an oversight hospital that agrees to operate the surge facility (if applicable). As noted in our previous report, the records could be owned by the State or Federal government; the question of safely storing them and assuring access to them is the primary concern.

Health Information Privacy

The HIPAA privacy regulations provide protection of individually identifiable health data.  The regulations protect every data element of individually identifiable health information of a patient when in custody of a covered facility, including those 15 identifiers that must be scrubbed from a record to meet minimum safety harbor standards under de-identified data under the privacy rule, including:

  • Names.
  • Geographic subdivisions smaller than a State.
  • Dates related to an individual except month.
  • Age except when grouped into categories.
  • Telephone and fax numbers.
  • Electronic mail addresses and URLs.
  • Social Security numbers.
  • Medical record numbers.
  • Account numbers.
  • Health insurance beneficiary numbers.
  • Certificate and license numbers.
  • Vehicle serial numbers and license plate numbers.
  • Biometric identifiers.
  • Full-face photographs.
  • Other unique identifying codes and characteristics.

The HIPAA Privacy Rule applies to 'covered entities' that are generally defined as health-care providers, health plans including private entities and government programs such as Medicare and Medicaid, and health-care clearing houses such as billing services.17 We assume that the rule would also apply to a surge facility, whether as a covered entity in its own right or as a subcontractor to a covered entity, depending on who has operational control of the facility when it opens in a mass casualty situation.

While the Privacy Rule encompasses a large number of data elements and applies to numerous entities that transfer health information, the Privacy Rule attempts to balance the protection of individual health information with the need to protect the public's health.18 The Rule contains special provisions for circumstances when private health information may be disclosed. First, the rule permits the use and disclosure of certain protected health information to public health authorities for public health purposes including but not limited to public health surveillance, investigations, and interventions.19 Second, HIPAA permits disclosure of protected health information when required by other Federal, State, Tribal, or local laws.20 Third, certain types of private health information may be disclosed for the purpose of research. 

It is not clear whether or not these exceptions would apply to hospitals and surge facilities during a mass-casualty event. Each exception is very fact specific and legal analysis may be needed. Clarification from the Federal government would be helpful, for communities actively involved in disaster preparedness planning.

Return to Appendix D Contents
Proceed to Next Section


The information on this page is archived and provided for reference purposes only.


AHRQ Advancing Excellence in Health Care