Disaster Preparedness for Your Office Practice

Julie Brightwell, JD, RN, Director, Healthcare System Patient Safety, The Doctors Company

Natural disasters can happen anywhere, at any time—and they can create widespread damage. Disasters include wildfires, hurricanes, tropical storms, tornadoes, earthquakes, floods, landslides, and other forms of severe weather. As we have seen in recent years, pandemic disease, a public health emergency, or workplace violence can also affect the availability and delivery of healthcare.

Disasters, which can occur suddenly and without warning, highlight the importance of advance preparation. A disaster can overwhelm an office practice, causing physical damage such as shattered windows, flood debris, power outages, disrupted telephone service, computer and technology system outages, unsafe drinking water, patient record destruction, medication exposure to temperature and humidity extremes, contaminated instruments and supplies, and building structure failure.

Clinicians may be forced to relocate their practices quickly―sometimes permanently―or move scheduled procedures to different facilities. For public safety, practices may be forced to close for days or even weeks. These disruptions can be catastrophic to the delivery of essential healthcare services to patients and, potentially, to the long-term financial well-being of the office and the individual providers. Is your practice prepared for a disaster?

Plan Now

Before the next disaster strikes, make sure your practice has a written plan in place. A checklist, ordered by priority and customized to specific types of disasters, can provide the framework for a comprehensive plan. The checklist should include these elements:

• Backup and recovery methods for electronic data, including the EHR and billing records. Methods could involve cloud storage or remote servers. Retain at least one copy of the backup offsite. All backup and recovery systems must be compliant with HIPAA.
• An inventory with photographs of tangible assets, such as medications, durable medical equipment, medical or dental devices and machinery, office and clinical supplies used during the provision of services, computers, artwork, fixtures, and furniture.
• Copies of important legal documents, such as licenses, leases, permits, contracts, deeds, insurance policies and certificates of coverage, tax records, office policies and procedures, and personnel files. These documents must be readily accessible if a disruption occurs.
• A list of important telephone contacts and email addresses, such as practice staff, healthcare professionals, vendors, insurance agents, licensing agencies, practice attorneys, and emergency response officials.
• A full-circle call tree for staff that outlines who contacts whom with mobile and alternative contact numbers.
• Instructions for setting up instant messaging technology (e.g., with chat messenger apps) that enables staff to communicate without a wireless network or cellular data connection.
• Instructions for securing the records of patients undergoing diagnostic testing and a list of outstanding diagnostic studies requiring follow-up.
• Guidelines for maintaining HIPAA compliance. The U.S. Department of Health and Human Services (HHS) provides protected health information guidance for planning and response to emergency situations (see Emergency Situations: Preparedness, Planning, and Response). Although the HIPAA Privacy Rule is not suspended during a natural disaster or other type of emergency, the HHS Secretary may waive certain provisions of the Privacy Rule (see “Is the Privacy Rule suspended during a national or public health emergency?”). The Office of Civil Rights may also issue notifications of temporary enforcement discretion. (For example, see the HHS notifications related to HIPAA and COVID-19.)
• Copies of certificates of insurance for your professional malpractice coverage and all product lines (such as general liability, cybersecurity, and employment practices) or instructions for contacting your agents or insurers directly to obtain proof of coverage and policy terms. These documents will be necessary if you are forced to temporarily relocate your practice or convert your delivery of care to a virtual format.
• Steps to follow upon returning from evacuation to ensure continuity of care and operational readiness to resume office functions.

Once your plan is in place, reevaluate it regularly and update all information—including disaster policies and procedures, contacts, insurance coverages, and legal documents.

If Disaster Strikes

Planning today makes accomplishing the following tasks easier in the event of a disaster:

Communication

• Stay current on emergency directives from state and local governmental disaster relief and recovery entities. Consider registering for text message, social media, and email alerts.
• Contact staff immediately to determine return-to-work time frames as permitted.
• Implement virtual staff briefings at the beginning and end of each day.
• Create temporary telephone, fax, and answering services if necessary.
• Notify external vendors and business associates about your practice interruption and targeted resumption of operation.
• Establish patient telephone triage. (Find more information in our article “Telephone Triage and Medical Advice Protocols.”)
• Establish telehealth services as capabilities permit. (For more information, see our article “Top Seven Tips for Telehealth.”)
• Implement temporary controls to ensure HIPAA compliance.

Patient records

• Determine and document the extent of damage to, or loss of, electronic and paper patient records and filing systems.
• Attempt to restore all damaged charts and relevant business records, and document inventory findings.
• Check the websites of your state licensing board and federal agencies, such as HHS and CMS, for specific guidance pertaining to lost or damaged records.
• Reconstruct lost charts at the next patient encounter and include a notation that the record is a re-creation.
• Date and initial all late entries and duplicate information in context of recovery efforts.
• Document all efforts to restore and protect existing records.
• Contact your insurance carrier for restorative services and/or claim procedures.
• Reestablish a filing system and temporary storage if necessary.
• Obtain legal guidance for patient notification during recovery efforts.

Computers and systems

• Contact computer service vendors to ensure the integrity and recovery of your systems.
• Inventory and document damage to hardware and software.
• Verify insurance coverage for repair or replacement costs and losses.
• Evaluate applicable warranties and consider contracting with an information technology restoration service.
• Reestablish filing systems and internal programs.
• Ensure data backup and periodically test compliance.

Office building

• Notify the building owner and your property insurance company regarding damage.
• Review inspection reports for identified damage and the schedule for repairs, and determine what impact the findings have on practice operations.
• Take appropriate measures regarding mold growth and removal if the building has suffered water or flood damage.
• Flush hot and cold water lines for 10 minutes if the building has been vacant for a week or more.
• Create an inventory of all equipment and medications that may have been exposed to water, extremes in temperature, or other contaminants. Repair, replace, or discard damaged items appropriately.

Practice and rehearse the plan’s protocols at least twice a year with all professional, administrative, and clerical staff, and participate in a community-based drill, if available. Address any areas that need improvement. An effective disaster preparedness plan will help ensure patient and staff safety and keep your practice focused on delivering care during an emergency.

For additional guidance, contact the Department of Patient Safety and Risk Management at (800) 421-2368 or by email.

---