Disaster Preparedness for Your Medical Practice

Julie Brightwell, JD, RN, Director, Healthcare System Patient Safety, Department of Patient Safety and Risk Management

Natural disasters occur repeatedly nationwide. They include wildfires, hurricanes, tropical storms, tornadoes, earthquakes, floods, landslides, and other forms of severe weather. The most recent addition to the list of possible disasters is pandemic disease—which continues to affect the availability and delivery of healthcare. Disasters can occur suddenly and without warning, highlighting the importance of advance preparation.

A disaster can overwhelm a medical practice, with physical damage that can include shattered windows, flood debris, power outages, disrupted telephone service, computer and technology system outages, unsafe drinking water, destroyed medical records, medication exposure to temperature and humidity extremes, contaminated instruments and supplies, and building structure failure.

Physicians may be forced to relocate their practices quickly―sometimes permanently―or to move scheduled procedures to different facilities. Practices may be forced to close for public safety for days or even weeks. These disruptions can be catastrophic to the delivery of appropriate medical services to patients and, potentially, to the long-term financial well-being of the office and the individual providers. Is your practice prepared for a disaster?

Plan Now

Before the next disaster strikes, make sure your practice has a written plan in place. A checklist, ordered by priority and customized to specific types of disasters, can provide the framework for a comprehensive plan. The checklist should include these elements:

  • Backup and recovery methods for electronic data, including the electronic health record and billing records. Methods could involve cloud storage or remote servers. Retain at least one copy of the backup offsite. All backup and recovery systems must be compliant with the Health Insurance Portability and Accountability Act (HIPAA).
  • An inventory with photographs of tangible assets, such as medications, durable medical equipment, medical devices and machinery, office and medical supplies used during the provision of services, computers, artwork, fixtures, and furniture.
  • Copies of important legal documents, such as licenses, leases, permits, contracts, deeds, insurance policies and certificates of coverage, tax records, office policies and procedures, and personnel files. These documents must be readily accessible if a disruption occurs.
  • A list of important phone contacts and email addresses, such as staff, healthcare professionals, vendors, insurance agents, licensing agencies, practice attorneys, and emergency response officials.
  • A full-circle call tree for staff that outlines who contacts whom with mobile and alternative contact numbers.
  • Instructions for setting up instant messaging technology (e.g., with chat messenger apps) that enables staff to communicate without a wireless network or cellular data connection.
  • Instructions for securing records of patients undergoing diagnostic testing and a list of outstanding diagnostic studies requiring follow-up.
  • Guidelines for maintaining HIPAA compliance. Although the HIPAA Privacy Rule is not suspended during a natural disaster or other emergency, the Secretary of Health and Human Services may waive certain provisions of the Privacy Rule, and the Office of Civil Rights may issue notifications of temporary enforcement discretion (e.g., see notifications related to COVID-19).
  • Copies of certificates of insurance for your medical malpractice coverage and all product lines (such as general liability, cybersecurity, and employment practices) or instructions for contacting your agents or insurers directly to obtain proof of coverage and policy terms. These documents will be necessary if you are forced to temporarily relocate your practice or procedures or convert your delivery of care to a virtual format.
  • Steps to follow upon returning from evacuation to ensure continuity of care and operational readiness to resume office functions.

Once your plan is in place, reevaluate it regularly and update all information—including disaster policies and procedures, contacts, insurance coverages, and legal documents.

When Disaster Strikes

Planning today makes accomplishing the following tasks more feasible during a disaster:


  • Stay current on emergency directives from state and local governmental disaster relief and recovery entities.
  • Contact staff immediately to determine return-to-work time frames as permitted.
  • Notify external vendors and business associates of your practice interruption and targeted resumption of operation.
  • Implement virtual staff briefings at the beginning and end of each day.
  • Create temporary phone, fax, and answering services if necessary.
  • Establish patient telephone triage.
  • Establish telehealth services as capabilities permit.
  • Implement temporary controls to ensure HIPAA compliance.

Medical records

  • Determine the extent of damage to, or loss of, patient records and filing systems.
  • Attempt to restore all damaged charts and relevant business records, and document inventory findings.
  • Check the websites of your state medical board and federal agencies, such as the Department of Health and Human Services and the Centers for Medicare and Medicaid Services, for specific guidance pertaining to lost or damaged records.
  • Document all efforts to restore and protect existing records.
  • Reconstruct lost charts at the next patient encounter with the notation that the record is a re-creation.
  • Contact your insurance carrier for restorative services and/or claim procedures.
  • Reestablish a filing system and temporary storage if necessary.
  • Obtain legal guidance for patient notification during recovery efforts.
  • Contemporaneously date and initial all late entries and duplicate information in context of recovery efforts.

Computers and systems

  • Contact computer service vendors to ensure integrity and recovery.
  • Verify insurance coverage for repair or replacement costs and losses.
  • Evaluate applicable warranties and consider contracting with an information technology restoration service.
  • Inventory and document hardware and software.
  • Document the type and extent of both lost electronic and paper data.
  • Ensure data backup and periodically test compliance.
  • Reestablish filing systems and internal programs.

Medical office building

  • Notify the building owner and your property insurance company regarding damage.
  • Review inspection reports for identified damage and the schedule for repairs, and determine what impact the findings have on practice operations.
  • Take appropriate measures regarding mold growth and removal if there is water or flood damage.
  • Flush hot and cold water lines for 10 minutes if the building has been vacant for a week or more.
  • Create an inventory of all equipment and medications that may have been exposed to water, extremes in temperature, or other contaminants. Repair, replace, or discard damaged items appropriately.

Practice and rehearse the plan’s protocols at least twice a year with all professional, administrative, and clerical staff, and participate in a community-based drill if available. Address any areas that need improvement. An effective disaster preparedness plan will help ensure patient and staff safety and keep your practice focused on delivering care during an emergency.


Evans A. Disaster strikes. Are you prepared? Experts offer advice on emergency preparedness planning. Dermatology World. August 2019. digitaleditions.walsworthprintgroup.com/publication/?m=12468&i=603278&p=1&pp=1

Paulsen E. Preparing your practice for a natural disaster. Duke Health. July 31, 2018. physicians.dukehealth.org/articles/preparing-your-practice-natural-disaster

U.S. Department of Health and Human Services, Office of the Assistant Secretary for Preparedness and Response (ASPR), Technical Resources, Assistance Center, and Information Exchange (TRACIE). asprtracie.hhs.gov/

U.S. Department of Homeland Security. Business Preparedness. Ready.gov

The guidelines suggested here are not rules, do not constitute legal advice, and do not ensure a successful outcome. The ultimate decision regarding the appropriateness of any treatment must be made by each healthcare provider considering the circumstances of the individual situation and in accordance with the laws of the jurisdiction in which the care is rendered.

J12532 08/20