How healthcare providers can best prepare for the worst.
Editor’s Note: The following is a transcript of a recent segment on Talk Ten Tuesdays by Julie Dooling, speaking on challenges and tips for healthcare organizations in the face of a natural disaster.
Collectively, we continue to learn from experiences where disasters and medical records are concerned. Katrina in 2005 was a huge wake-up call for the industry.
At that time, it was reported that a total of 400,000 paper records were destroyed in a matter of hours, all in an era when electronic health records (EHRs) and health information exchange (HIE) were only beginning to take shape. Fast forward to the Joplin, Mo. F5 tornado in May 2011, when an entire hospital was destroyed: fortunately, this time the hospital system had been actively archiving its medical records and had just migrated their data to an off-site data center hundreds of miles away.
Recently, Hurricane Michael affected patients in Alabama, Georgia, and Florida. This time was different. We heard of progress through the use of HIE, when organizations worked together to ensure that important documentation was accessible to support continuity of care.
Let’s take time to celebrate this success, going from destroyed paper records to the use of HIE in a disaster!
What are some other best practices? The American Health Information Management Association (AHIMA) has a Disaster Planning and Recovery Toolkit that includes details about the following:
When planning for disaster, the first order of business is the creation of a comprehensive iterative plan known as a business continuity plan. The plan consists of these areas:
- Risk assessment and analysis
- Downtime and contingency planning
- Disaster recovery planning
- Data backup planning
- Emergency mode operations or crisis management planning
HIPAA in times of disaster:
- The privacy rule is not suspended during a public health emergency, but the secretary of the U.S. Department of Health and Human Services (HHS) may waive certain provisions. Affected organizations should contact the regional or national Office of Civil Rights (OCR) office as soon as possible to inquire about a HIPAA waiver and its use in a particular situation.
- The OCR provides comprehensive guidance and bulletins regarding emergency responses. In the case of Hurricane Michael, it released a bulletin indicating that a waiver was granted up to 72 hours from the time a hospital implemented its disaster protocol. The waiver generally addresses sanctions and penalties under the HIPAA privacy rule that may otherwise apply to the covered hospital: for example, asking patients to agree to or object over sharing information with family members or friends involved in their care.
