Templates / Emergency action plan

Compliance and security

Emergency action plan

Free PDF • 3 pages, print-ready • Clinician-reviewed

Tanja Lepcheska Last updated September 4, 2026 Reviewed by Dr. Vanja Kitanova

---

An emergency action plan (EAP) is the script your team follows when the fire alarm sounds mid-treatment. It names who raises the alarm, who leads patients out, who calls 911, and where everyone meets. OSHA’s 29 CFR 1910.38 sets what the plan must contain, but it only applies when another OSHA standard requires an EAP.

Even where no rule forces one, a written plan is strongly recommended for every practice. Patients in reclined chairs, on IV lines, or under sedation can’t simply walk out, so your plan has to account for them. What follows covers OSHA’s six required elements, the healthcare additions, a five-step build, and how to keep the plan drilled and current.

Template details

Template type

Plan

Format

Printable PDF, 3 pages

Fields to complete

44 fields

Best for

Compliance and security

Key takeaways

An emergency action plan (EAP) is a written plan for how staff respond to fires, medical crises, natural disasters, and other emergencies.

OSHA’s 29 CFR 1910.38 applies only when another OSHA standard requires an EAP, such as the ethylene oxide or formaldehyde rules. The fire extinguisher rule does not.

Once a plan is required, employers with more than 10 employees must put it in writing. A written plan is strongly recommended for every practice either way.

Healthcare plans add patient evacuation, a device shutdown order, privacy-safe family updates, and a head count that includes patients.

Review the plan whenever staff, layout, or equipment change, and log every drill with its date and what went wrong.

An EAP tells every person what to do and when

An emergency action plan is a written document for how your practice responds to a crisis. Fires, medical emergencies, natural disasters, and active threats all belong in it. It sets out who does what, when they do it, and how people communicate while the emergency unfolds. OSHA and most safety bodies shorten the name to EAP.

An EAP covers immediate safety, meaning evacuation routes, shelter procedures, first-responder handoffs, and the call chain. An emergency response plan is a different document. It covers recovery and getting the practice back open.

Healthcare facilities subject to CMS Conditions of Participation face their own documented emergency preparedness requirements. The Joint Commission also sets emergency management standards for accredited organizations.

A drilled plan protects the practice, too. If staff don’t know what to do and someone gets hurt, the liability lands on you. A documented, rehearsed EAP shows you took reasonable steps to keep people safe.

OSHA sets six required elements under 29 CFR 1910.38

OSHA’s 1910.38 does not, on its own, require any employer to have an EAP. It applies when another OSHA standard calls for one. Examples include process safety management (1910.119), hazardous waste operations (1910.120), ethylene oxide (1910.1047), and formaldehyde (1910.1048).

For practices, the last two are the ones to check. Formalin used for biopsy specimens is a formaldehyde solution, and some facilities sterilize instruments with ethylene oxide.

A common myth is that the portable fire extinguisher rule (1910.157) triggers an EAP. It doesn’t. That rule only exempts or limits some employers that already have an EAP and a fire prevention plan.

Once a plan is required, 1910.38 sets the format. Employers with more than 10 employees must put it in writing. Those with 10 or fewer may communicate it orally, though a written copy still makes training easier. Two questions settle whether OSHA requires a written plan at your practice.

Whichever branch applies, the OSHA plan must cover these six elements:

• Procedures for reporting fires or emergencies: How employees alert leadership and emergency services (phone number, code word, alarm protocol).
• Emergency escape procedures and evacuation routes: Clearly marked routes, assembly points, and procedures for employees who cannot use standard exits.
• Procedures for employees who run critical operations before evacuating: Who shuts down equipment, secures patient data, or manages life-support systems first.
• Accounting for all employees after evacuation: A head count at the assembly point confirms everyone is accounted for, including patients where practical.
• Rescue and medical duties: Names and contact information of employees designated for first aid, AED operation, or patient triage.
• Names and job titles of emergency contacts: Who employees should reach for more information about the plan or their role within it.

In healthcare, the plan has to go further than these six elements, and the next two sections show where.

Six building blocks every practice plan needs

OSHA’s list is the floor. A practice plan also has to protect patients, data, and clinical equipment, so build it from these six parts.

1. Map two ways out and a safe meeting point

Map every primary and secondary exit route and mark them clearly on floor plans. Choose a safe assembly point a reasonable, upwind distance from the building (many safety guides suggest 100 feet or more). Make sure it won’t block fire engines or ambulances. For multi-story practices, identify stairwells and confirm access for staff with mobility limitations.

2. Keep a contact directory you can reach outside

Maintain an updated list of names, phone numbers, and roles for all staff. Include emergency services (911, poison control, the nearest hospital ED), facility management, leadership, and your medical director. A paper list gets lost or goes out of date fast. Keep a copy staff can open on their phones outside the building.

3. Give every role a named owner and a backup

Assign these roles, then rotate them yearly so several people can cover each one on a short-staffed day:

• Evacuation coordinator: leads people out.
• Medical responder: handles first aid and AED use.
• Communication officer: calls emergency services and families.
• Equipment shutoff manager: shuts down servers and medical devices.
• Accountability checker: confirms all staff and patients are accounted for.

4. Decide how the alert travels

Define how staff communicate during an emergency. A phone tree suits small teams, with leadership calling named staff in order. Larger practices often use a text or app-based alert, or a check-in point where staff report in. Whichever you choose, keep patient details out of group chats and personal phones.

5. Know when to stay put instead of leaving

Some threats make evacuation unsafe, such as an active threat or a nearby hazmat incident. For those, identify a secure room with a lockable door and a phone signal. Stock it with water, first aid supplies, and a charged communication device. Then write down clear criteria for when to shelter in place and when to evacuate.

6. Name who gives first aid and who calls 911

Designate trained staff for AED operation and first aid. Clarify which clinicians (RNs, physicians, EMTs) may give emergency care on-site, and when to call 911 instead. Staff can check responsiveness first with a validated tool like the AVPU scale. Note where the AED, first aid kit, and oxygen are kept.

A medical emergency action plan protects patients, devices, and data

Patients make a practice plan harder than an office plan. Some can’t walk, some are attached to equipment, and all of them keep their privacy rights during a crisis.

Plan for patients who can’t walk out

If patients are on-site during treatment, assign staff to help them out of exam rooms and reclined treatment chairs. Patients on monitors or IV therapy need a named staff member beside them. Mental health practices should pick a quiet evacuation area for patients in crisis who may need de-escalation.

Shut devices down in a set order

Designate staff to shut down, secure, or move critical equipment, such as patient monitors, IV pumps, oxygen, ultrasound machines, and lab analyzers. Document the shutdown steps for each device and the order to follow, with life-support systems last. Med spas and aesthetic practices should add laser devices and injectable warmers.

Lock down patient data on the way out

Designate a staff member to secure patient records before evacuating. On electronic systems, that means logging out or locking screens rather than leaving charts open. With cloud-based medical records management, the data stays on the server, so nobody has to carry files out.

Paper charts, medication lists, and intake forms shouldn’t be left in view. If time is short, leave systems as they are and get out. Once everyone is clear, lock and alarm the building to stop unauthorized access to patient data.

Update families without sharing private details

Decide how you’ll tell families about a patient’s status without releasing private information. Options include a designated phone line, text updates with consent documented in advance, or a secure patient portal. Before relying on texts, check what HIPAA compliant texting lets you send.

Build your plan in five steps

Building an EAP from scratch can take several weeks, and a template shortens it. Most of the delay comes from chasing information, so collect it first.

Before you start, gather these four things

• A current floor plan with every exit, stairwell, and fire extinguisher marked.
• A staff list with roles, phone numbers, and each person’s emergency contact.
• An inventory of critical equipment, with the shutdown steps for each device.
• Numbers for local emergency services, the nearest hospital ED, and your building owner.

Work through the five steps

1. Identify potential emergency scenarios: Fire, medical emergency, natural disaster, active threat or lockdown, utility failure, and a nearby hazmat incident. For each, note who is at risk and how your practice would respond.
2. Map evacuation routes and assembly points: Walk the practice with your team. Mark primary and secondary exits, stairwells, and accessible routes. Pick the assembly point and an alternate in case the first is unsafe. Post a floor plan with routes where staff see it daily.
3. Assign and document employee roles: List all staff. Give each person a primary role (evacuation, medical, communication, accountability, equipment shutoff) and a backup. Write down each role’s duties, and hand every staff member a pocket card with their role.
4. Build the emergency contact directory: Collect each staff member’s name, role, phone, and emergency contact through digital forms. Update the list quarterly or whenever staff change. Add external contacts, such as local emergency services, the hospital ED, your medical director, and the landlord.
5. Define communication procedures: Decide who calls emergency services, who alerts staff, and who handles families. Document the phone tree or alert system, test it quarterly, and make sure every staff member knows their place in the chain.

After the five steps, compile the plan into a single document. Name one EAP coordinator, usually the practice manager, and book the first training session.

Who needs a written EAP, and who should have one anyway

A written EAP is legally required when another OSHA standard calls for one and you have more than 10 employees. Beyond that legal floor, a written plan is strongly recommended for every practice, whatever its size. These settings carry the highest stakes if something goes wrong:

• Medical spas and aesthetic practices: Multi-location med spas with staff and patient safety duties during laser procedures, injectable treatments, or other time-sensitive services.
• Mental health and therapy practices: Outpatient psychiatry, psychology, counseling, and therapy practices where patient de-escalation and trauma-informed evacuation may be needed.
• Physical therapy and sports medicine practices: Facilities with large patient volume, equipment-dependent care, and multi-room layouts where evacuation coordination is complex.
• IV therapy and infusion centers: Practices where patients receive ongoing infusions, requiring careful steps for disconnecting and evacuating patients on active IV therapy.
• Primary care and occupational health practices: Private practices, employer health centers, and occupational medicine practices serving many patients at once.
• Dental and specialty surgical centers: Practices performing procedures under sedation, where airway management and equipment shutdown are safety-critical.

If your practice is on this list, write the patient-specific sections first. Those are the parts a generic office plan leaves out.

What a documented plan gives your practice

A written, drilled plan pays off in five ways.

• Regulatory compliance: A documented, regularly updated EAP satisfies 1910.38 wherever it applies. It also supports CMS emergency preparedness rules and Joint Commission standards. Missing documentation can lead to citations, fines, or accreditation findings.
• Liability reduction: Staff who follow a written plan show due diligence, which helps if a negligence claim or workers’ compensation dispute follows. Some insurers may also consider documented preparedness.
• Faster response and fewer errors: Staff who know their roles don’t improvise. Evacuation moves faster, the head count gets done, and critical equipment is protected.
• Patient safety and trust: Patients and families feel safer knowing your practice has a plan. It shows them that safety is taken seriously.
• Staff confidence: Employees who have practiced drills feel prepared rather than anxious. Clear procedures take the guesswork out of a stressful moment.

Emergency action plan vs. emergency response plan: Who handles what

The two terms get mixed up, but they cover different stages of an incident.

Many practices benefit from having both. The EAP handles the crisis itself, and the ERP handles the recovery. For leadership decisions and communications after an incident, a crisis management plan adds a third layer.

Drills and reviews keep the plan working

A written EAP only works if staff know it. OSHA requires the employer to review the plan with each employee when it’s first developed and when someone is newly assigned. The same applies when an employee’s duties change or the plan itself changes.

The standard has no blanket annual training mandate. Many practices still run a yearly refresher, and quarterly drills are common in healthcare.

Train everyone when the plan launches

Once the EAP is final, schedule a 30-minute training for all staff. Walk through each scenario, explain each role, show exit routes and assembly points, and hand out pocket cards. Record attendance, because that sheet is your evidence if OSHA inspects. An OSHA inspection checklist shows what else an inspector may ask for.

Review yearly and drill regularly

Review the full EAP once a year, or sooner when staff, the building, equipment, or hazards change. Run a drill, whether an evacuation, a shelter-in-place exercise, or a tabletop scenario. Record how long evacuation took, whether everyone was accounted for, and what went wrong. Then adjust the plan.

Five changes that call for an immediate update

Beyond the yearly review, update the EAP right away when:

• Staff join or leave (new names, roles, contacts).
• The practice expands, relocates, or reconfigures (new exit routes, assembly points).
• Equipment or operations change (new life-support systems, medication storage).
• An emergency occurs. Debrief the team and log what happened on an incident report form.
• A safety audit or inspection identifies a shortcoming.

Document each update with the date and reason. That audit trail shows regulators you take emergency preparedness seriously.

Common mistakes that break a plan on the day

Watch for these during drills and reviews:

• The role list still names staff who left months ago.
• The assembly point sits where fire engines and ambulances need to park.
• The head count covers staff but not patients or visitors.
• Only one person knows the device shutdown order, and they’re off that day.
• The only copy of the contact list lives on a computer inside the building.

How Pabau keeps emergency contacts and staff records current

Most of the work behind an EAP is admin. Contact details change, people join and leave, and training certificates expire. In Pabau, the practice management platform we build, that admin sits in the same system your team uses for bookings and records.

Digital forms replace the paper emergency contact sheet. Staff profiles then hold each person’s details and uploaded documents, such as first aid certificates. When someone joins or leaves, you update one profile rather than reprinting the plan.

Pabau’s compliance management software also controls who sees what. Role-based permissions limit which staff can open patient records. Time-stamped notes and stored communications build the audit trail an inspector asks for.

For patient-facing updates, SMS messaging reaches booked patients in one send when an emergency or a drill disrupts the day.

Keep emergency contacts and staff records current

Pabau’s digital forms and staff profiles keep emergency contacts, role details, and training certificates in one place. Update them as your team changes, so the plan stays usable.

Book a demo

Conclusion

Start with the patient-specific sections, because that’s where a generic office template falls short. Decide who stays with a patient on an IV line, which device goes off last, and how families get news without private details leaking.

Then check whether another OSHA standard, such as the formaldehyde rule, applies to your practice. If it does and you have more than 10 employees, a written plan is required. If it doesn’t, write one anyway, because the people in your treatment chairs depend on it.

The trade-off is time. Building the plan can take several weeks, and a template shortens it. Drills will keep exposing weak spots, which is exactly why you run them. Book a demo to see how Pabau keeps your staff contacts, roles, and training records ready for the next drill.

Continue your research

Writing your staff safety rules down? OSHA handbook template covers the OSHA requirements a practice handbook should spell out for staff.

Recording workplace injuries after an incident? OSHA Form 300A explains the posting deadlines, filing rules, and penalties for the annual injury summary.

Worried about privacy during an evacuation? Patient confidentiality explains what it means and how to protect it day to day.

Need a written privacy policy alongside your EAP? HIPAA compliance policy template gives you a starting point for documenting how your practice protects patient data.

Frequently asked questions