Emergency operations plan for behavioral health programs

Who requires an emergency plan

• The Joint Commission: an emergency operations plan based on the HVA (EM.12.01.01), staff education (EM.15.01.01), exercises (EM.16.01.01) and evaluation of the program after exercises and real events (EM.17.01.01). The chapter was rewritten for behavioral health effective July 1, 2025, with fewer elements of performance and more emphasis on the HVA, leadership oversight and staff training.
• CARF: written emergency procedures, tested by unannounced drills with a written analysis (health and safety, section 1.H).
• CMS: Medicare-certified community mental health centers need an emergency plan, policies and procedures, a communication plan, and training and testing, with the plan reviewed at least every 2 years (42 CFR 485.920).
• OSHA: an emergency action plan when an OSHA standard requires one, in writing (employers with 10 or fewer employees may communicate it orally), with procedures for reporting emergencies, evacuation and exit routes, accounting for everyone, and who to contact (29 CFR 1910.38), plus a fire prevention plan (1910.39).
• HIPAA: a contingency plan with a data backup plan, a disaster recovery plan and an emergency mode operation plan (45 CFR 164.308(a)(7)).
• Texas HHSC: written procedures for medical and psychiatric emergencies, with staff trained (26 TAC 564.707); residential programs also need evacuation procedures and drills (564.1203).

One well-built plan can satisfy all of them. Write it once, cross-reference the standards in an appendix, and keep one version.

The 12 sections of the plan

This is the outline we use for a one- or two-site outpatient program. A residential program adds sheltering, feeding and overnight staffing to sections 5 and 6.

Section	What it says	Proof a surveyor looks for
1. Scope and hazards	Sites, services, hours, who's usually in the building, and the top hazards from this year's HVA	The signed HVA, dated before the plan
2. Who's in charge	Who activates the plan and leads the response (by title, with two backups), and who can close a site	Names on the current contact list match the titles
3. Communications	Staff call or text tree; how clients and emergency contacts are told about closures and changes; referral partners, the landlord, utilities, payers that need notice; a backup if phones are down	A tested call tree; a closure message template
4. Staff roles and staffing	Who does what in an evacuation, a shelter-in-place and a closure; how services are staffed if people can't get in	Training records; roles posted in the quick guide
5. Client safety	Evacuation routes and the meeting place; shelter-in-place rooms; head count from the day's attendance; clients who need help to get out; clients at high risk who need a call during a closure	Maps in every client room; drill head counts
6. Continuing care	How groups and individual sessions continue (telehealth, an alternate site), how clients on medication or at risk are reached, how crises are handled while closed	The telehealth procedure and consent forms; a crisis line on closure messages
7. Records and technology	Backups and how to restore them, downtime paper forms, access to the EHR from elsewhere, what to do in a ransomware attack	A dated test restore; the downtime packet
8. Utilities and supplies	What happens without power, water, HVAC, phones or internet, for hours or days; flashlights, go-bag, first aid, naloxone; medication refrigerator plan	The critical utilities assessment; monthly supply checks
9. Hazard quick guides	One page per top hazard (below), at the front desk and in each office	Staff can find and explain them
10. Recovery and reopening	Who decides to reopen, the building check before clients return, catching up late documentation (dated as late), notifying payers and HHSC if needed	After-action report from the last real event
11. Training and exercises	Training at hire and yearly; the exercise schedule and how critiques change the plan	Exercise records, sign-in sheets, critiques
12. Review and approval	The review date, what changed and why, and leadership's signature	A signed, dated approval page and change log

Hazard quick guides

Nobody reads a 40-page plan while the alarm is going off. Each top hazard gets a one-page guide: the first three things to do, who to call, where to go. Typical ones for a behavioral health program:

• Fire: RACE (rescue, alarm, contain, extinguish or evacuate), the exit routes and meeting place, and who takes the attendance list for the head count. See fire drill requirements.
• Tornado or severe weather: the interior, windowless room or hallway on the lowest floor where everyone shelters, who monitors alerts, and when it's over.
• Hurricane: a closure timeline keyed to the National Hurricane Center's alerts (a hurricane watch means hurricane conditions are possible, usually issued about 48 hours ahead; a warning means they're expected, about 36 hours ahead), the closure message, the telehealth switch, and the reopening check.
• Active threat: run, hide, fight, from the CISA active shooter preparedness materials; lockdown rooms that lock from inside; the code word staff use; calling 911.
• Overdose or medical emergency: call 911, give naloxone, start CPR if trained, where the kit and AED are, who meets EMS, and the incident report afterward (see incident reporting timelines).
• Agitated or threatening person: de-escalation, when to call 911, keeping exits open. Texas outpatient programs prohibit restraint and seclusion (except as it relates to court-committed clients; 26 TAC 564.706(b)), so the guide relies on de-escalation and help from outside.
• Bomb threat call: keep the caller talking and fill in the DHS bomb threat checklist by the phone; who calls 911; whether to evacuate.
• Power, water or HVAC failure: how long you can stay open, when to move groups to telehealth or close, the medication refrigerator, and the landlord's emergency number.
• Phone, internet or EHR outage, or cyberattack: the downtime paper forms, how to reach clients, who calls the IT vendor, and when a privacy incident becomes a possible breach.
• Infectious disease outbreak: screening, masks and cleaning, moving groups online, and staff exposure steps.

The front-desk version fits on one sheet: emergency numbers (police, fire, poison control, landlord, utilities, the director's cell), the site address to give 911, and the first step for each hazard.

Texas: telehealth, closures and residential rules

• Telehealth in a disaster. Texas chemical dependency rules allow screening and assessment by electronic means only with synchronous audio-video. Audio-only is allowed only during a declared state of disaster in the county, with a documented justification that it's safe and clinically appropriate (and why video wasn't used) and the person's verbal consent; in-person care is offered when the person asks for it (26 TAC 564.801(h), 564.803(b); HHSC GL 21-3004-A2). Put those three conditions in your continuing-care section, and check your payers' telehealth rules too.
• Long closures. HHSC retires a site's license when services stop there for more than 60 days, unless you've asked for inactive status (26 TAC 564.406). A plan for a flooded or damaged building should include calling HHSC early. Moving to a new address is a change in status; see our sister site's guide to relocating a treatment program.
• Residential programs. Evacuation procedures that include people with disabilities, fire drills on each shift at least quarterly, and posted exit diagrams (26 TAC 564.1203).
• Statewide hazards. Texas programs plan for more than hurricanes on the coast and tornadoes up north: the February 2021 winter storm and its power outages showed why every Texas plan needs a multi-day utility outage section, and extreme heat belongs on most Texas HVAs.

Testing the plan: exercises and critiques

A plan is only as good as its last test. Rotate scenarios from the top of your HVA, and mix the formats:

Format	What it is	Good for
Tabletop	Leaders talk through a scenario hour by hour around a table	Hurricane closure and reopening, a ransomware attack, a multi-day power outage
Live drill	Staff and clients actually do it: shelter, lock down, evacuate	Tornado shelter, active threat lockdown, overdose response
Functional or full scale	A drill that also tests communications and outside partners	A call-tree test during an evening group, a drill with local EMS
A real event	The emergency itself, documented like an exercise	Counts as an exercise if you write it up and critique it

Check your accreditor's current manual for how many exercises a year it expects and of which type. We run one every six months, keep them at least 4 and no more than 12 months apart, and write the critique within 5 business days: what worked, what didn't (communications, roles, client safety, supplies), and what changes in the plan, each with an owner and a date. The critiques go to the quality committee and into next year's plan review.

The yearly review and signature

Once a year, leadership reviews the plan and signs a dated approval page. A real review checks that:

• The plan reflects this year's top hazards from the HVA.
• Changes from drill critiques and real events are made.
• The staff and client communication plan is current.
• Contact lists are current: staff, vendors, utilities, the landlord, the alternate site.
• Continuity is covered: records backup, alternate site, payroll.
• Staff were trained on the updated plan.
• The approval page is signed and dated, with a list of what changed.

Review it sooner after a move, a new service, a new building or a real emergency. If you're opening a program and need the plan written, Cima Consulting's program policy and procedure manual ($4,500) includes the environment-of-care and emergency plans with a Texas rule crosswalk.

How Comply keeps the plan current

Comply doesn't write your plan; it keeps the work around it on schedule and on file:

• The yearly cycle: the HVA, then the EOP review with the seven checks above and a required photo of the signed approval page, then the critical utilities assessment.
• Exercises every six months, with scenarios to rotate (severe weather, hurricane tabletop, active threat, overdose, bomb threat, utility failure, communications outage). Before each one, Comply warns if it's less than 4 or more than 12 months since the last. Real events can be logged as the exercise.
• The critique opens as its own item, due 5 business days after the exercise, and each failed line becomes a fix with an owner.
• Quarterly checks that evacuation maps and quick guides match the building and the current plan, and monthly checks of naloxone, AED and first aid supplies.

Everything lands in the survey binder under Emergency Management. See the Joint Commission checklist for how surveyors read it, or take the Comply tour.

Questions

What's the difference between an emergency operations plan and an emergency action plan?

An OSHA emergency action plan (29 CFR 1910.38) is about getting employees out safely: reporting, evacuation, accounting for people, contacts. An emergency operations plan covers that and more: clients, communications, continuing care, records, utilities and recovery. Most programs fold the action plan into the EOP.

How often should a behavioral health emergency plan be reviewed?

Yearly is the common practice for accredited programs, and after any move, new service or real emergency. CMS requires Medicare-certified community mental health centers to review and update the plan at least every 2 years.

How often should we run emergency exercises?

Check your accreditor's current manual for the number and type it expects. We run one every six months, 4 to 12 months apart, alternating tabletops and live drills chosen from the HVA, with a written critique within 5 business days. Fire drills are scheduled separately.

Can we switch to audio-only telehealth when a storm closes the office in Texas?

For screening and assessment under the Texas chemical dependency rules, only during a declared state of disaster in the county, with a documented justification and the person's verbal consent; otherwise use synchronous audio-video. Check each payer's telehealth policy before billing.

Is there an EOP template for outpatient programs?

The 12-section outline above is a good start. Ready.gov's business preparedness materials and your county emergency management office are free sources. Whatever you use, cut what doesn't fit your building; a plan copied from a hospital is a common survey finding.

The rest of this set: the hazard vulnerability analysis that comes first, environment of care rounds, the ligature risk assessment, incident reporting and the Texas HHSC inspection checklist. The full schedule is in the compliance calendar.

Sources

• The Joint Commission, R3 Report Issue 49: New and revised Emergency Management standards for behavioral health care and human services (effective July 1, 2025).
• 42 CFR 485.920 (CMHC emergency preparedness) and ASPR TRACIE, CMHC requirements summary.
• OSHA, 29 CFR 1910.38, emergency action plans and 1910.39, fire prevention plans; 45 CFR 164.308(a)(7) (HIPAA contingency plan).
• 26 Tex. Admin. Code chapter 564 (564.706, 564.707, 564.801(h), 564.803(b)), 564.406 and 564.1203; HHSC GL 21-3004-A2 (services by electronic means).
• NOAA National Hurricane Center (watches and warnings); CISA, active shooter preparedness and the DHS bomb threat checklist; Ready.gov for businesses.

This guide is general information, not legal or emergency-management advice. Cima Consulting and Comply aren't law firms. Comply isn't affiliated with or endorsed by The Joint Commission, CARF, CMS or OSHA.