3-point plan protects medical practice technology in disasters
■ A practical look at information technology issues and usage
- WITH THIS STORY:
- » External links
Having lived through Hurricane Irene and a blizzard in 2011, Gus Lara, clinical applications analyst at ProCure Proton Therapy Center in Somerset, N.J., said the cancer treatment practice had experience to draw on as it prepared for the arrival of Hurricane Sandy on Oct. 29.
But, as Lara soon found out, you learn something new each time disaster strikes. You just hope the lesson doesn’t come by way of a devastating oversight — none bigger than putting off disaster planning until you have experienced disaster for the first time.
Many organizations, including the American Medical Association and the American Health Information Management Assn., have developed guidance for practices developing disaster preparedness and response plans. Using one of those guides, many of which are available for free online, practices should think of every scenario that could shut down their operations and develop their plans accordingly.
Three basic core elements should be included in every plan:
- Security of the practice’s data.
- A contingency plan for creating records after a disaster hits.
- The identification of possible backup power and Internet sources.
If a natural or man-made disaster destroys a practice’s patient records, the data need to be backed up at an off-site location so it can be recovered when the practice comes back online.
Practices that have locally hosted EHR systems, meaning the data are stored on an in-house server, should have an off-site data backup plan. Bill O’Byrne, executive director of NJ-HITEC, New Jersey’s regional extension center, said the best solution is a cloud-based vendor that makes it easy to duplicate patient data to the cloud’s off-site servers.
Whether data storage is being handled by your cloud-based electronic health record vendor or a third-party data storage and recovery center, the most ideal location would be far from the practice so that the possibility of the same event wiping out both the practice and the data center is nearly impossible. So if your vendor is local, check to make sure it has a backup facility in a different region. When the data storage plan is in place, regular backups should be conducted at least once a day.
When a practice has established every type of disaster that is possible — fire, weather or anything else deemed a threat — a plan should be made for each one, O’Byrne said. For example, a plan for when employees are able to get back to the office; a plan for where employees can meet if the destruction is massive, as it was in many areas in Sandy’s path; a plan for when employees are stuck inside the office; and a plan for where a remote clinic might be set up.
Julie Dooling, director of health information management solutions at AHIMA, said a phone tree should be created not only with each staff member’s phone number, but also with a list of their service providers. She said she heard from practices that lived through a 2011 tornado in Joplin, Mo., when some cell phone carriers had service wiped out while others were still operating. The list should detail who will initiate the calls and who will be calling whom.
The next step of the contingency plan is to detail how the practice will convert back to paper for a temporary period and how records will be transferred when patients are referred to different care facilities. Dooling said it’s often difficult for multiple records to be combined and matched to the appropriate patients. Small practices can play a crucial role in this process because they may know the patients better than, say, a hospital would. Hospitals should be included in the phone tree so that the care coordination will go smoothly with everyone operating from the same playbook.
Backup power and Internet sources
Although the ProCure facility had power restored within two days, Lara said he soon realized it would take several days for Internet service to be restored. This was not something for which he had planned. The clinic still had access to patient records, which are stored on in-house servers that were not damaged in the storm. But had they needed to access their backup data, it would have required an Internet connection, Lara said.
Although the Internet wasn’t crucial to direct patient care, there were many online tasks that clinicians couldn’t perform without it, Lara said. Employees used their own smartphones and tablets, and more devices were purchased after the storm to get them through the outage. Those backup devices will now be stored in-house in the event of future outages.
Other practices weren’t as fortunate as ProCure and went without power for several days.
But despite having no power service in his area, Firpo Guerrero, MD, a gastroenterologist in Newark, N.J., reopened his clinic just two days after the storm thanks to the prior purchase of a generator. Dr. Guerrero’s generator could be hooked up to the natural gas lines, eliminating the worry of running out of fuel during times of gas rationing, an issue others encountered in New Jersey and New York.
Most disasters hit without warning, but when you have the luxury of time and fair warning, last-minute precautions can be taken. Among them, O’Byrne said, is to make sure that all electronic equipment is picked up off the floor in case of flooding. One last backup of the data should be done before the last person leaves the office. If there’s no time, unhooking the servers — assuming they are encrypted — and taking them with you can save your practice from losing several years’ worth of data, he said.
Dooling said planning for a natural disaster should be a joint effort between practices and others in the community, including other physician practices, hospitals and government agencies responsible for responding to disasters.
“Don’t do it by yourself,” she said. “If a natural disaster happens, we’re all in it together, so plan together as well.”