Preparing for COVID-19: Eight essential steps for hospitals to protect patients, employees, and their communities

February 24, 2020

Health Care Alert

Author(s): Sarah E. Swank, Rachel L. Conn

The novel coronavirus (COVID-19) is creating worldwide concern as the number of cases continues to increase. Transmission-related fears continue to grow. Hospitals need to ensure they are taking steps to protect their patients, employees, and the communities they serve. It is important to understand that a pandemic could happen in the United States and how to prepare. In this article, we will discuss the legal and accreditation requirements that will guide hospitals’ decisions on preparedness. We will provide answers to common questions regarding pandemic preparedness for COVID-19 and future outbreaks of disease.

Step 1: Assess preparedness preparedness saves lives

In recently guidance, the Centers for Disease Control and Prevention (CDC) recommends that all hospitals prepare for patients with confirmed or suspected COVID-19. Similarly, the Center for Medicare & Medicaid Services (CMS) issued a memorandum urging hospitals to review CDC’s guidance and their own infection prevention and control policies and practices to prevent the spread of infection, as well as reminding hospitals of their requirement to maintain an emergency preparedness plan as a condition of participation in Medicare.[1] While recent news focuses on COVID-19, both COVID-19 and the flu are aerosol transmissible diseases (ATDs) and share similar symptoms such as fever, cough, and shortness of breath. Currently, deaths from the seasonal flu in the United States outnumber deaths from COVID-19.

The CDC created an assessment tool for hospitals to assess the following elements of preparedness for COVID-19:

  • Infection prevention and control policies and training for health care personnel (HCP),
  • Process to rapidly identify and isolate patients with confirmed or suspected COVID-19,
  • Patient placement,
  • Transmission-based precautions,
  • Movement of patients with confirmed or suspected COVID-19 within the facility,
  • Hand hygiene,
  • Environmental cleaning,
  • Monitoring and managing HCP,
  • Visitor access and movement within the facility, and
  • Regularly monitoring the situation on COVID-19.[2]

Hospitals should assess their preparedness in accordance with these elements, which are further detailed in the CDC assessment tool. CMS provided several resources, including online courses developed in conjunction with the CDC focusing on infection control.[3]

Step 2: Screen patients for COVID-19

Patients who arrive at hospitals seeking treatment need to be screened. At the same time, hospitals must manage the screening process both for compliance with applicable anti-dumping laws and public health standards during outbreaks.

CDC screening guidelines

With respect to screening patients, the CDC advises hospitals to evaluate patients who have a fever or lower respiratory illness symptoms and who in the past fourteen (14) days since the first onset of symptoms have a history of either travel to China or close contact with a person known to have COVID-19.[4]  This guidance may change as the incubation period is revaluated. The CDC recommends that hospitals identify at-risk patients before or immediately upon arrival at the facility, provide a mask to and isolate such patients in an airborne infection isolation room (AIIR), if available, and provide supplies for respiratory hygiene and cough etiquette.

EMTALA obligations

CMS provided guidance regarding a hospital meeting Emergency Medical Treatment and Labor Act (EMTALA) obligations during the Ebola outbreak. This guidance is informative on how hospitals can meet their obligation preparing for COVID-19 patient screenings. Under EMTALA, hospitals are required to conduct an appropriate medical screening examination of all individuals who come to the emergency department (ED), including individuals who are suspected of having been exposed to the disease.[5] CMS advised that it is a violation of EMTALA for hospitals with EDs to use signage that presents barriers to individuals who may have been exposed to Ebola from coming to the ED or to otherwise refuse to provide an appropriate medical screening exam to anyone who has come to the ED for examination or treatment of a medical condition. CMS made clear that the EMTALA requirements for hospitals are the same for individuals with possible Ebola symptoms as for all other possible emergency medical conditions.[6] Hospitals should follow proper transfer requirements under EMTALA and state law after screenings.

Step 3: Care for infected patients

Hospitals should begin preparing for caring for infected patients, including identifying spaces in the hospital to care for infected patients, supply needs, and visitor access.


The CDC recommends that patients with symptoms or other respiratory infection not wait among other patients seeking care. Instead, hospitals should identify a separate, well-ventilated space that allows waiting patients to be separated by six (6) or more feet, with easy access to respiratory hygiene supplies.


CMS recommends the review of CDC information and the review of appropriate personal protective equipment (PPE) use and availability (e.g., supplies). The Joint Commission, which points to the CDC and other public health partners as the appropriate source of information and guidance, advises that routine practices that are currently required under The Joint Commission standards with respect to preventing the transmission of communicable diseases will decrease the risk of transmission.[7]

Visitors access

The CDC recommends that hospitals develop a plan for visitor access and movement within the hospital that has been reviewed and updated within the last twelve (12) months. When defining visitors, the hospital should note that visitors can include household members such as children who themselves may be carriers or test positive. The plan should restrict visitation to rooms of confirmed or suspected COVID-19 patients and provide for alternative mechanisms for interaction, such as video-call applications or tablets. Hospitals can consider exceptions based on end-of-life situations or when a visitor is essential for the patient’s emotional well-being and care.[8] If visitors are allowed to enter patient rooms, the policy should define the PPE to be used by visitors; instruct visitors on items such as hand hygiene, limiting surfaces touched, and use of PPE; and maintain a record of visitors who enter and exit the room and ensure that visitors limit their movement within the hospital. Visits to patients with COVID-19 should be scheduled and controlled to allow for screening visitors for symptoms before entering the hospital and evaluating the risk of visitors’ health and their ability to comply with precautions. Hospitals should direct exposed visitors to report any symptoms for a period of at least fourteen (14) days after the last known exposure to the sick patient. Hospitals should consider review and revisions to their visitor policies to ensure compliance with these recommendations.

Step 4: Report suspected cases of COVID-19

Reporting of confirmed cases is a critical component of public health efforts. The Office for Civil Rights of the U.S. Department of Health and Human Services (OCR) issued a bulletin on Health Insurance Portability and Accountability (HIPAA) privacy standards (Privacy Rule) and COVID-19, which outlines other permitted disclosures that may occur in the context of COVID-19, including disclosures at the direction of a public health authority to a foreign government agency that is acting in collaboration with the public health authority and/or to persons at risk of contracting or spreading a disease or condition if other law authorizes the covered entity to notify such persons.[9] Disclosures should continue to comply with the minimum necessary standard of the Privacy Rule, and a covered entity may rely on the CDC’s representations that the protected health information (PHI) requested by the CDC about patients exposed to or suspected or confirmed to have COVID-19 is the minimum necessary for the public health purpose. Internally, access to PHI should continue to be limited to those workforce members who need it to carry out their duties.

Step 5: Hospital employees Caring for those who care for others

A hospital’s employees, health care personnel (HCP), and staff are key when preparing, preventing, screening, and caring for patients during an outbreak. Hospitals should be aware of the roles employees play and their duties and obligations to employees under the law. CDC recommends that hospitals ensure that staff is trained, equipped, and capable of practices needed to meet the following:


Prevent the spread of COVID-19 within the facility:

  • Promptly identify and isolate patients with possible COVID-19 and inform the correct staff and authorities,
  • Care for a limited number of patients with confirmed or suspected COVID-19,
  • Potentially care for a larger number of patients in the context of an outbreak,
  • Monitor and manage HCP that might be exposed to COVID-19, and
  • Communicate effectively within the facility and have appropriate external communications related to COVID-19.[10]

Exposure control plans (ECPs)

Hospitals should review and update their Exposure Control Plans (ECPs) to ensure that their ECPs cover the following either directly or by reference:

  • Respiratory protection plan,
  • Personal protective equipment (PPE) plan,
  • Bloodborne pathogen (BBP) plan, and
  • Disaster response plan.[11]

These plans should be reviewed by a cross-disciplinary team, including, but not limited to, infection control, environmental services, security, human resources, patient relations, and communications/media relations with both management and employee participation. These plans should include but not be limited to items such as:

  • The basic procedures that are followed for all ATDs (such as, coughing/sneezing protocols, handwashing protocols, decontamination procedures) and BBPs as well as separate sections or attachments covering specific procedures for reasonably anticipated specific ATDS and BBPs;
  • A list of all job classifications in which employees have occupational exposure, typically with reference to specific tasks and work areas where exposures can be reasonably anticipated;
  • A list of all engineering and work practice controls and procedures used to minimize exposure and how they are implemented;
  • A detailed list of PPE requirements including, but not limited to, respiratory protection by task, location, job classification, and/or procedure;
  • A description of medical screening and medical services provided to employees, including vaccination policies (since vaccination policies have become such a hot button issue in some communities, this is discussed in more detail below);
  • A list of the specific control measures used for each operation or work area including applicable engineering and work practice controls, cleaning and decontamination procedures, and PPE; and
  • A list of all assignments or tasks requiring personal or respiratory protection.

Other considerations include, but are not limited to, how to identify, isolate, and transfer suspect or actual ATD cases and procedures for eliminating exposure and detailed procedures to follow in the event of an exposure incident. Hospitals should include in their ECPs procedures to evaluate exposures, determine causation, and collect information to prevent future exposures; to implement initial and annual training in the prevention and control of ATDs and BBPs and a description of or reference to the training specifically provided; to encourage employee involvement in updating the plan; and special procedures for facilities that are expected to receive persons arriving from a “surge” event.

Supply shortages

There are no emergency exemptions to applicable Occupational Safety and Health Administration (OSHA) regulations. For example, while supplies of N95 respirators can become depleted during outbreaks, an employer can still be cited for not providing proper PPE. Review supply chain arrangements to ensure proper supplies are available for employee safety.

Telecommute/essential personnel

During an outbreak, employees may be asked to stay home to stop the spread of the disease. In health care, certain employees are needed to care for patients and are critical to a pandemic outbreak. Who is essential to be on-site? What if essential personnel fail to report to work? Hospitals should determine beforehand who will be considered essential staff during an outbreak or surge event and if there will be disciplinary actions if they fail to show up to work. Hospitals should define by position who can or should work remotely during an outbreak. These items should be detailed in the hospital’s emergency preparedness plan.


What if an employee refuses to work with someone or treat someone based on their country of origin or where they last have traveled? Employers may have employees who refuse to work with other employees based on their national origin and/or race depending on the outbreak’s origin. Employers should remind employees of their anti-discrimination policies and take additional steps to prevent any potential discriminatory behavior. This policy should also address issues relating to treatment of patients based on country of origin or other categories of discrimination.

Other employment issues

An outbreak will implicate other laws that prohibit discrimination against persons with disabilities or medical conditions, privacy laws, wage and hour laws, obligations under workers’ compensation laws, and collective bargaining obligations. OSHA regulations also protect workers from retaliation. This includes those exposed to a communicable illness, as well as those raising good-faith concerns about potential exposure. Employers must take steps to prevent such retaliation.

Step 6: Review vaccination policies

Currently, there is no vaccine for COVID-19 and scientists are racing to develop a vaccine. During the 2009 H1N1 (swine flu) outbreak, a vaccine was developed and later incorporated into annual seasonal flu shots. In anticipation of the potential for a new vaccine and seasonal flu levels, hospitals should also consider whether to require employees to be vaccinated from certain highly communicable illnesses. Hospitals should consider if a new vaccine is developed, who should receive it first among your employees, medical staff members, and the community, and document these decisions before the need arises. In addition, hospitals should consider their position if employees and/or medical staff members refuse vaccination during a pandemic.

While offering, as opposed to mandating, vaccination avoids legal and operational complications, hospitals can balance employee rights with what is in the best interests of patients, co-workers, and members of the community when establishing a vaccination policy for staff. State laws should be consulted regarding vaccinations and reporting obligations regarding to vaccinations.

  • Hospitals should determine which vaccines for highly communicable illnesses, such as COVID-19 if and when developed, will be provided.
  • Hospitals contemplating a vaccination policy should consider including provisions that exclude two classes of workers: those with a health condition that could be compromised by the vaccine and those who object to the vaccine on religious grounds. Hospitals should review the current laws regarding these potential exemptions as part of their consideration.
  • If a hospital determines it will adopt and enforce a mandatory vaccination policy for employees, it must next determine the consequences for an employee’s noncompliance. For example, will there be corrective action or termination for failing to vaccinate within the recommended timeframe for that year’s flu vaccine? Hospitals should also consider potential legal risks for these actions before implementation.
  • When drafting or reviewing a vaccination policy, the hospital should keep in mind who will be required to be given the vaccine and prioritizing during a shortage. Each group of individuals comes with its own set of legal and operational issues. Careful consideration of the scope of the policy before implementation can avoid legal issues down the road. In assessing how far-reaching a hospital’s policy should be, it is important to also consider the financial and administrative costs associated with a broad policy.
  • Hospitals should consider current and potential union involvement, and the union position on developing and implementing a vaccination policy, including consulting any union contracts. Several unions that include health care worker membership have taken a clear stance on the issue. Hospitals should carefully review any collective bargaining agreements before implementing a policy and pay particular attention to its management rights provisions.

Hospitals must think through all of the issues associated with instituting a mandatory vaccination policy to ensure that the policy will fare well in the face of both a legal and public challenge. Consistency is key to avoid discrimination and civil liberty claims. Practical issues such as vaccine shortage must be addressed in any policy. If the policy will be implemented and enforced by committee, the composition of the committee should be carefully considered. If employees are granted exemptions within the scope of the policy, the hospital’s treatment of these employees must not be retaliatory or punitive. Overall, the hospital should educate its staff and patients on its policy rationale.

Step 7: Manage communications

Crisis communication plans are critical during a crisis such as a pandemic. Widespread fears can lead to misinformation or failure to seek treatment. How can hospitals address communication issues without creating panic in the public and while following patient privacy laws, such as HIPAA?

Alerting family members

Under HIPAA, a covered entity may disclose a patient’s protected health information with a patient’s family members, relatives, friends, or other persons identified by the patient as involved in the patient’s care. Patients must be given an opportunity to opt out of such disclosure.

Responding to media inquiries

What if the press calls to discuss a hospital’s patients? What if a patient gives an interview to the press, can the hospital respond? Under HIPAA, a covered entity and its business associates may not release information to the media unless the requestor of information asks for the patient by name and not beyond information in a facility directory if a patient has not opted out of being listed in the directory. Media responses should be consistent with hospitals’ HIPAA-compliant policies and procedures. Even if a patient shares a story regarding the hospital, the hospital’s response, if any, should be limited and cannot include patient’s protected health information as defined by HIPAA.

Communications with employees and medical staff

It is important to communicate with employees and medical staff members about exposures under OSHA. Providing clear and transparent information to employees and medical staff members can help to dispel fears and aid in ensuring the safety of patients, employees, medical staff members, and the community.

Employees and social media

What if the hospital’s employees post about the disease at the hospital on social media? Section 7 of the National Labor Relations Act guarantees employees the right to engage in concerted activities for mutual aid or protection. This includes raising concerns about working conditions such as health and safety issues related to outbreaks. Section 7 can extend to social media posts employees make concerning these issues, and hospitals’ responses to such posts should be consistent with hospitals’ policies and procedures relating to social media, if any.

Step 8: Training and education

A key part of all preparedness is training. Part of this training and education is needed now to be prepared. Hospitals should review their disaster preparedness plan and conduct drills. Hospitals should consult up-to-date governmental and accreditation resources to assist with the development of training materials. In addition, The Joint Commission recently issued a bulletin that reminds hospitals that they are required to have a plan for managing a surge in infectious patients and recommends that now might be a good time for hospitals to conduct a drill to test their procedures.[12]


We are not certain the impact of the current COVID-19 or future pandemic outbreaks will have for hospitals in the United States. As we wait to see the outcome, hospitals should begin preparedness activities. These activities should be guided by up-to-date and compliant policies and procedures and timely training, education, and drills. Being prepared can save lives.

Preparedness webinar

For more information, listen to the webinar 2019 Novel Coronavirus, Part II: Health Care Provider Legal Preparedness sponsored by the CDC’s Public Health Law Program and Center for Preparedness and Response in association with American Health Lawyers Association (AHLA), The American Bar Association (ABA) and Association of Healthcare Emergency Preparedness Professionals (AHEPP) live on Tuesday, February 25, 2020 at noon EST. Click here to learn more.

  1. Information for Healthcare Facilities Concerning 2019 Novel Coronavirus Illness (2019-nCoV), Ref: QSO 20-09-ALL, Department of Health & Human Services, Centers for Medicare & Medicaid, dated February 6, 2020; 42 CFR § 482.15.
    [Back to reference]
  2. Coronavirus Disease 2019 (COVID-19) Hospital Preparedness Assessment Tool, Centers for Disease Control and Preparedness.
    [Back to reference]
  3. Information for Healthcare Facilities Concerning 2019 Novel Coronavirus Illness (2019-nCoV), Ref: QSO 20-09-ALL, Department of Health & Human Services, Centers for Medicare & Medicaid, dated February 6, 2020.
    [Back to reference]
  4. Evaluating and reporting Persons Under Investigation (PUI), Centers for Disease Control and Preparedness.
    [Back to reference]
  5. Emergency Medical Treatment and Labor Act (EMTALA) Requirements and Implications Related to Ebola Virus Disease (Ebola), Ref: S&C: 15-10-Hospitals, Department of Health & Human Services, Centers for Medicare & Medicaid, dated November 21, 2014, and EMTALA and Ebola Virus Disease – Questions and Answers (Q+A).
    [Back to reference]
  6. Emergency Medical Treatment and Labor Act (EMTALA) and Ebola Virus Disease (EVD) – Questions and Answers (Q+A), Ref: S&C: 15-24-Hospitals, dated February 13, 2015.
    [Back to reference]
  7. The Joint Commission Bulletin, updated February 14, 2020.
    [Back to reference]
  8. Interim Infection Prevention and Control Recommendations for Patients with Confirmed Severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) or Persons Under Investigation for SARS-CoV-2 in Healthcare Settings, updated February 12, 2020, Centers for Disease Control and Preparedness.
    [Back to reference]
  9. Office for Civil Rights, U.S. Department of Health and Human Services Bulletin: HIPAA Privacy and Novel Coronavirus, dated February 2020. With respect to foreign government agencies, see 45 CFR § 164.512(b)(1)(i); with respect to persons to prevent or control the spread of diseases, see 45 CFR § 164.512(b)(1)(iv).
    [Back to reference]
  10. Coronavirus Disease 2019 (COVID-19) Hospital Preparedness Assessment Tool, Centers for Disease Control and Preparedness.
    [Back to reference]
  11. See,The Respiratory Protection Standard, 29 CFR § 1910.134; Various PPE standards, including 29 CFR § 1910.132; and the BBP Standard 29 CFR § 1910.1030.
    [Back to reference]
  12. Bulletin, updated February 14, 2020, The Joint Commission available here and here; see also The Joint Commission standard on infection control at IC.01.06.01.
    [Back to reference]

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

Back to top