Emergency action plan

Most practices operate without a formal emergency action plan, hoping emergencies never happen. But when a fire, medical crisis, or security threat occurs, the absence of clear HIPAA-safe procedures creates chaos. Staff scramble to make decisions, patients remain unaccounted for, and liability exposure explodes. OSHA’s 29 CFR 1910.38 standard only requires a written plan when another OSHA rule calls for one. In practice, most workplaces trigger that requirement anyway, often through the portable fire extinguisher standard alone. Treat it as a practical necessity, not an optional nice-to-have.

This guide explains what an emergency action plan must include and how to build one tailored to your practice’s unique risks. It also covers why an emergency action plan template saves months of compliance work.

The purpose of an EAP

An emergency action plan is a written document. It specifies how your practice will respond to fires, medical emergencies, natural disasters, active threats, and other crises. OSHA and most safety bodies shorten the term to the acronym EAP.

The plan designates who does what, when they do it, and how communication happens during the emergency. That is the practical emergency action plan meaning: a rehearsed script, not paperwork nobody reads.

For healthcare settings, an EAP is usually both a regulatory obligation and a patient-safety imperative. An emergency response plan covers organizational recovery and continuity. An EAP instead focuses on immediate employee and patient safety actions: evacuation routes, shelter procedures, first-responder coordination, and communication chains.

Under OSHA 29 CFR 1910.38, an EAP is required only when another OSHA standard calls for one. Most workplaces meet that trigger anyway, commonly through the portable fire extinguisher rule. Healthcare facilities subject to CMS Conditions of Participation face additional documented emergency preparedness requirements, and The Joint Commission mandates emergency management standards for accredited organizations. Compliance is non-negotiable.

The EAP is also your legal shield. If an emergency occurs and staff don’t know what to do, your practice becomes liable for injuries and damage. A documented, regularly drilled EAP demonstrates due diligence and significantly reduces liability exposure.

OSHA requirements under 29 CFR 1910.38

OSHA standard 29 CFR 1910.38 does not, on its own, require any employer to have an emergency action plan. It applies only when another OSHA standard, such as the portable fire extinguisher rule, requires an EAP for that workplace. Once a plan is required, 1910.38 sets the format instead of the trigger. Employers with more than 10 employees must put the plan in writing. Those with 10 or fewer employees may communicate it orally, though written documentation is still recommended for clarity and liability protection.

The OSHA EAP must address these six required elements:

• Procedures for reporting fires or emergencies: How employees alert leadership and emergency services (phone number, code word, alarm protocol).
• Emergency escape procedures and evacuation routes: Clearly marked routes, assembly points, and procedures for employees who cannot use standard exits.
• Procedures for employees who operate critical operations before evacuating: Staff responsible for shutting down equipment, securing patient data, or managing life-support systems before leaving.
• Accounting for all employees after evacuation: A head count at the assembly point confirms everyone is accounted for, including patients where practical.
• Rescue and medical duties: Names and contact information of employees designated for first aid, AED operation, or patient triage.
• Names and job titles of emergency contacts: Who employees should reach for more information about the plan or their role within it.

In healthcare, compliance extends beyond OSHA. Compliance management software helps practices track and document training completion, building the audit trail regulators expect.

Core components every EAP needs

What should be included in an emergency action plan goes beyond OSHA’s core 1910.38 elements. Healthcare-specific additions address patient safety, data protection, and medical operations.

Evacuation routes and assembly points

Map all primary and secondary exit routes and mark them clearly on floor plans. Identify a safe assembly point at least 100 feet from the building. For multi-story practices, identify stairwells and confirm accessibility for staff with mobility limitations. In healthcare, include procedures for patients in treatment (evacuation chairs for reclined patients, protocols for those on IV therapy or monitoring equipment).

Emergency contact directory

Maintain an updated list of names, phone numbers, and roles for all staff. Include emergency services (911, poison control, hospital ED), facility management, upper leadership, and external medical director. A paper emergency contact form gets lost or goes out of date fast. Digital intake forms make it simple to collect and update staff contact information in one system.

Employee roles and accountability

Assign these specific roles, then rotate the assignments annually so multiple staff can cover each one:

• Evacuation coordinator: leads people out.
• Medical responder: handles first aid and AED use.
• Communication officer: calls emergency services and family.
• Equipment shutoff manager: shuts down servers and medical devices.
• Accountability checker: confirms all staff and patients are accounted for.

Communication protocols

Define how staff communicate during the emergency. Options include a phone tree where leadership calls specific staff. Other choices are a text or app-based alert system, or a communication hub where staff check in. In healthcare, designate a HIPAA-safe way to alert family members without violating patient privacy. Internal team messaging keeps emergency communication within secure channels rather than personal phones or unsecured texts.

Shelter-in-place procedures

For threats that make evacuation unsafe (active threat, hazmat incident nearby), identify a secure room with a lockable door and communication access. Stock it with water, first aid supplies, and a communication device. Establish clear criteria for when to shelter-in-place vs. evacuate.

First aid and medical response

Designate trained staff for AED operation and first aid. For healthcare practices, clarify which staff can provide emergency care (RNs, clinicians, EMTs) and when to call 911 vs. treating on-site. Staff can assess responsiveness first using a validated tool like the AVPU scale. Document the location of the AED, first aid kit, and oxygen equipment.

A medical emergency action plan for practices and medical spas

A medical emergency action plan has to do more than a generic EAP: it covers patient evacuation, medical equipment shutdown, and HIPAA-safe communication. Healthcare settings need practice-specific extensions.

Patient evacuation procedures

If patients are on-site during treatment, you need a dedicated patient evacuation procedure. Assign staff to assist patients leaving exam rooms or reclined treatment chairs. Make sure patients in critical states, such as those on monitors or IV therapy, have staff support. For mental health practices, identify a quiet evacuation area for patients in crisis who may need de-escalation during the emergency.

Medical equipment and supply shutdown

Designate staff to shut down, secure, or transport critical equipment: patient monitors, IV pumps, oxygen supplies, ultrasound machines, lab analyzers. Document the shutdown procedure for each device and the order in which to shut them down (e.g., life-support systems last). For medical spas and aesthetic practices, include procedures for laser devices and injectable warmers.

Patient data and HIPAA protection

Designate a staff member to secure or back up patient records before evacuating. For electronic systems, this may mean initiating a cloud backup or closing systems securely, rather than abandoning open screens. In a true crisis, secure the building and leave systems as they are. Never leave patient charts, medication lists, or intake forms exposed during evacuation. If staff evacuate, secure the facility right away. Lock it, alarm it, and monitor it to prevent unauthorized access to patient data.

HIPAA-safe family communication

Develop a communication plan that informs families of patient status without publicly releasing private information. Use a designated phone line, text notification system (with patient consent documented in advance), or a secure practice communication portal. Email and SMS campaigns keep emergency notification within secure channels rather than unsecured group texts.

How to build your EAP: Step by step

Building an EAP from scratch takes 4-6 weeks for a typical practice. Using a template accelerates the process to 1-2 weeks.

1. Identify potential emergency scenarios: fire, medical emergency, natural disaster, active threat or lockdown, utility failure, hazmat incident nearby. For each, note who is at risk and what your practice-specific response would be.
2. Map evacuation routes and assembly points: Walk your practice with your team. Mark primary and secondary exits, stairwells, and accessible routes. Identify the assembly point and designate an alternate meeting place if the primary location is unsafe. Create a floor plan with routes and post it where staff can see it daily.
3. Assign and document employee roles: List all staff. Assign each person a primary role (evacuation, medical, communication, accountability, equipment shutoff) and a backup. Document role responsibilities and contact info. Create a pocket card each staff member carries with their assigned role.
4. Build the emergency contact directory: Collect emergency contact information via digital forms from every staff member (name, role, phone, emergency contact). Update this list quarterly or when staff changes. Include external contacts: local emergency services, hospital ED, medical director, building owner/landlord.
5. Define communication procedures: Decide: Will the practice call emergency services, or will each staff member? Who alerts staff? How is family communication handled? Document the phone tree or alert system, test it quarterly, and ensure all staff know their role in the chain.

After completing these five steps, compile everything into a single document. Assign one staff member, usually the practice manager, as the EAP coordinator, and schedule the first training.

Who needs a written EAP

Most practices already need a written EAP because another OSHA standard, most commonly the portable fire extinguisher rule, requires one. Beyond that legal floor, a documented plan is worth having in any practice, regardless of staff count. Every emergency action plan industry looks a little different, but these settings carry the highest stakes if something goes wrong:

• Medical spas and aesthetic practices: Multi-location medical spas with staff and patient safety responsibilities during laser procedures, injectable treatments, or other time-sensitive services.
• Mental health and therapy practices: Outpatient psychiatry, psychology, counseling, and therapy practices where patient de-escalation and trauma-informed evacuation may be needed.
• Physical therapy and sports medicine practices: Facilities with large patient volume, equipment-dependent care, and multi-room layouts where evacuation coordination is complex.
• IV therapy and infusion centers: Practices where patients receive ongoing infusions, requiring careful procedures for disconnection and evacuation of patients on active IV therapy.
• Primary care and occupational health practices: Private GP practices, employer health centers, and occupational medicine practices serving multiple patients simultaneously.
• Dental and specialty surgical centers: Practices performing procedures under sedation where patient airway management and equipment shutdown are safety-critical.

Every practice benefits from a documented EAP, regardless of staff count. This applies especially to medical spas, where liability protection, patient safety, and staff confidence all improve with a clear plan.

What a documented plan gets you

How does an emergency action plan benefit your workplace? Five ways stand out.

Regulatory compliance: A documented, regularly updated EAP satisfies OSHA 29 CFR 1910.38 wherever it applies. It also aligns with CMS emergency preparedness CoPs and Joint Commission standards for accredited organizations. Non-compliance results in citations, fines, and loss of accreditation.

• Liability reduction: When an emergency occurs and staff follow the EAP, you demonstrate due diligence. This significantly reduces your exposure to negligence claims and worker’s compensation disputes. Insurance companies often offer premium discounts for documented emergency preparedness. A quick cost-benefit analysis template can help justify the time investment to practice ownership.

• Faster response and fewer errors: Staff who know their roles do not improvise or panic. Evacuation is faster, accountability is achieved, and critical equipment is protected. Every minute counts in a real emergency.

• Patient safety and trust: Patients and families feel safer knowing your practice has a plan. Documented emergency preparedness also supports informed consent conversations. Patients see that your practice takes safety seriously.

• Staff confidence and morale: Employees who understand the EAP and have practiced drills feel empowered, not fearful. Clear procedures reduce anxiety and improve retention.

Emergency action plan vs. emergency response plan: Key differences

These terms are often confused, but they serve different purposes.

Aspect	Emergency action plan (EAP)	Emergency response plan (ERP)
Scope	Immediate safety actions (evacuation, shelter, first aid).	Broader organizational response and recovery.
Timeframe	First 30 minutes to 2 hours (during the emergency).	Hours to weeks (aftermath and recovery).
Regulatory requirement	OSHA 29 CFR 1910.38 (required only when another OSHA standard triggers it).	Not OSHA-mandated (CMS, state, and industry-specific rules apply).
Focus	Employee and patient safety: who leaves, where they go, how they communicate.	Business continuity: resuming operations, restoring records, managing liability.

Many practices benefit from having both. The EAP handles the crisis itself, while the ERP handles the recovery. Practice management dashboards help track and document both plans, ensuring nothing falls through the cracks during review cycles.

Keeping your EAP current: Training and drills

A written EAP means nothing if staff don’t know it. OSHA requires plan review and training when the plan is first developed and when an employee is newly assigned. The same applies when an employee’s duties change or the plan itself changes. There is no blanket annual training mandate in the standard itself. Many practices still choose an annual refresher as best practice, with quarterly drills common in healthcare settings.

Initial training

When the EAP is finalized, schedule a mandatory 30-minute training for all staff. Walk through each scenario, explain each role, show exit routes and assembly points, and distribute pocket cards listing each person’s role. Record attendance. This is your compliance documentation if OSHA inspects.

Annual updates and drills

Conduct a full EAP review annually (or when staff, facility, equipment, or hazards change). Run a drill: an evacuation drill, a shelter-in-place drill, or a tabletop scenario. Document how long it took to evacuate, whether accountability was achieved, and what went wrong. Adjust the plan based on lessons learned. Automated task reminders can alert staff to drill schedules and training deadlines, ensuring nothing slips through the cracks.

Update triggers

Beyond annual review, update the EAP immediately when:

• Staff join or leave (new names, roles, contacts).
• The practice expands, relocates, or reconfigures (new exit routes, assembly points).
• Equipment or operations change (new life-support systems, medication storage).
• An actual emergency occurs. Debrief the team and log what happened on an incident report form.
• A safety audit or inspection identifies a shortcoming (regulatory feedback).

Document each update with the date and reason. This audit trail shows regulators you take emergency preparedness seriously.

How Pabau streamlines emergency contact collection and staff communication?

Most of the work behind an EAP is admin: collecting staff contact details, keeping role assignments current, and reaching everyone fast when it matters. Practice management software like Pabau handles that admin so the plan stays usable instead of going stale in a drawer.

Pabau’s digital forms replace the paper emergency contact form. Every staff member’s details, role, and backup contact sit in one searchable record instead of a filing cabinet. When someone joins or leaves the team, updating that record takes minutes, not a reprint.

For communication, Pabau’s team messaging sends a single alert to every practitioner and staff member at once. It keeps a record of who saw it. That is the same HIPAA-safe channel your EAP’s phone tree or alert system needs, without a separate app to manage.

Conclusion

An emergency action plan is not a luxury. Most practices already fall under OSHA’s 1910.38 through another standard, and every practice benefits from one regardless. The plan answers one fundamental question: “When an emergency happens, what do we do?” Without it, chaos. With it, your team knows exactly who evacuates first, who calls emergency services, who performs first aid, and how families get notified.

The free template above gives you a starting point. Adapt it to your practice’s layout, staff size, patient population, and hazards. Train all staff at least annually, drill quarterly, and update the plan whenever anything changes. Document everything. Your EAP becomes both your shield against liability and the roadmap that saves lives. Book a demo to see how digital forms and team messaging integrate emergency planning into your day-to-day practice operations.

Frequently asked questions