MDF Healthcare Advisory · Reviewed September 23, 2026
1. What are we trying to test?
Pick specific objectives. For example: how an agency confirms patient status during a prolonged outage, how a practice moves into downtime operations, or how a facility escalates a staffing disruption. “Review the plan” is too broad to tell you whether the exercise worked.
2. Who makes the decisions?
Identify the roles that can authorize actions, contact outside partners, communicate with staff, and escalate unresolved issues. Include the people who actually perform those handoffs—not only the person who maintains the binder.
3. What assumptions could fail?
Test ordinary dependencies: phones, internet, transportation, staffing, suppliers, building access, and the availability of a key leader. A scenario becomes useful when it challenges a dependency your organization relies on.
4. What will we observe?
Capture the decisions, missing information, unclear responsibilities, and workarounds that emerge. Define in advance how observers will record those findings without adding patient or personnel details that the exercise does not need.
5. Who owns the changes?
Turn observations into a short improvement plan. Give each action an owner and a review date. Revisit the important gaps after the exercise, and update the plan or training when the process changes.
The setting determines the requirements.
A physician practice’s HIPAA contingency procedures are not identical to the facility-level emergency-preparedness programs applicable to certified nursing facilities, home health agencies, RHCs, or FQHCs. Exercise types, frequency, documentation, and any exceptions must be checked for the actual provider type. This checklist does not establish regulatory exercise credit.
Primary references: long-term-care requirements, home-health requirements, and HIPAA contingency planning.
Explore preparedness and continuity support →