Disaster Preparedness for Your Office Practice

Natural and human-caused disasters can happen anywhere, at any time. A disaster can overwhelm an office practice and create catastrophic damage that affects the delivery of essential patient care and the financial well-being of the office and individual practitioners. Is your practice prepared for a disaster?

Weather and climate-related disasters include hurricanes, tropical storms, tornadoes, earthquakes, floods, landslides, and wildfires. Other types of disasters include public health emergencies (such as outbreaks of infectious diseases or bioterrorist attacks), workplace or community violence, arson, dam breaks, large-scale industrial accidents, and hazardous materials spills.

When a disaster strikes, practitioners may be forced to relocate quickly―sometimes permanently. For public safety, practices may be closed for days or even weeks because the office building or its contents have experienced damage. Examples include the following:

• Structural or physical damage, such as shattered windows or flood debris.
• Power outages or disruptions to technology systems or telephone services.
• Unsafe drinking water.
• Contaminated instruments and supplies.
• Medication exposure to temperature and humidity extremes.
• Patient record destruction.

Plan Now

Before the next disaster strikes, make sure your practice has a written risk identification and mitigation plan in place. A checklist, ordered by priority and customized to specific types of disasters, can provide the framework for a comprehensive plan. The checklist should include these elements:

• Backup and recovery methods for electronic data, including the EHR and billing records. Methods could involve cloud storage or remote servers. Retain at least one copy of the backup offsite. All backup and recovery systems must be compliant with HIPAA.
• An inventory with photographs of tangible assets, such as medications, durable medical equipment, medical or dental devices and machinery, office and clinical supplies used during the provision of services, computers, artwork, fixtures, and furniture.
• Copies of important legal documents, such as licenses, leases, permits, contracts, deeds, insurance policies and certificates of coverage, tax records, office policies and procedures, and personnel files. These documents must be readily accessible if a disruption occurs.
• A list of important telephone contacts and email addresses, such as practice staff, healthcare professionals, vendors, insurance agents, licensing agencies, practice attorneys, and emergency response officials.
• A full-circle call tree for staff that outlines who contacts whom with mobile and alternative contact numbers.
• Instructions for setting up instant messaging technology with an offline messaging app that enables staff to communicate without a wireless network or cellular data connection.
• Instructions for securing the records of patients undergoing diagnostic testing and a list of outstanding diagnostic studies requiring follow-up.
• Guidelines for maintaining HIPAA compliance. The U.S. Department of Health and Human Services (HHS) provides protected health information guidance for planning and response to emergency situations (see “Emergency Situations: Preparedness, Planning, and Response”). Although the HIPAA Privacy Rule is not suspended during a natural disaster or other type of emergency, the HHS Secretary may waive certain provisions (see “Is the HIPAA Privacy Rule suspended during a national or public health emergency?”). The Office of Civil Rights may also issue notifications of temporary enforcement discretion. (For example, see the HHS notifications related to HIPAA and COVID-19.)
• Copies of certificates of insurance for your professional malpractice coverage and all product lines (such as general liability, cybersecurity, and employment practices) or instructions for contacting your agents or insurers directly to obtain proof of coverage and policy terms. These documents will be necessary if you are forced to temporarily relocate your practice or convert your delivery of care to a virtual format.
• Steps to follow upon returning from evacuation to ensure continuity of care and operational readiness to resume office functions.

Once your plan is in place, reevaluate it regularly and update all information—including disaster policies and procedures, contacts, insurance coverages, and legal documents.

If Disaster Strikes

Planning today makes accomplishing the following response and recovery tasks easier in the event of a disaster:

Communication

• Stay current on emergency directives from state and local governmental disaster relief and recovery entities. Consider registering for text message, social media, and email alerts.
• Contact staff immediately to determine return-to-work time frames as permitted.
• Implement virtual staff briefings at the beginning and end of each day.
• Create temporary telephone, fax, and answering services if necessary.
• Establish patient telephone triage. (Find more information in our article “Telephone Triage and Advice: Patient Safety Strategies.”)
• Establish telehealth services as capabilities permit. (For guidance, see our Telehealth resources.)
• Implement temporary controls to ensure HIPAA compliance.
• Notify external vendors and business associates about your practice interruption and targeted resumption of operation.

Patient Records

• Determine and document the extent of damage to, or loss of, electronic and paper patient records and storage systems.
• Attempt to restore all damaged patient and relevant business records, and document inventory findings.
• Check the websites of your state licensing board and federal agencies, such as HHS and CMS, for specific guidance pertaining to lost or damaged records.
• Reconstruct lost charts at the next patient encounter and include a notation that the record is a re-creation.
• Date and initial all late entries and duplicate information in context of recovery efforts.
• Document all efforts to restore and protect existing records.
• Contact your insurance carrier for restorative services and/or claim procedures.
• Reestablish a storage system and use temporary storage if necessary.
• Obtain legal guidance for patient notification during recovery efforts.

Computers and Systems

• Contact computer service vendors to ensure the integrity and recovery of your systems.
• Inventory and document damage to hardware and software.
• Verify insurance coverage for repair or replacement costs and losses.
• Evaluate applicable warranties and consider contracting with an information technology restoration service.
• Reestablish storage systems and internal programs.
• Ensure data backup and periodically test compliance.

Office Building

• Notify the building owner and your property insurance company regarding damage.
• Review inspection reports for identified damage and the schedule for repairs to determine what impact the findings have on practice operations.
• Take appropriate measures regarding mold growth and removal if the building has suffered water or flood damage.
• Flush hot and cold water lines for 10 minutes if the building has been vacant for a week or more.
• Create an inventory of all equipment and medications that may have been exposed to water, extremes in temperature, or other contaminants. Repair, replace, or discard damaged items appropriately.

Practice and rehearse the plan’s protocols at least twice a year with all professional and practice staff, and participate in a community-based drill, if available. Address any areas that need improvement. An effective disaster preparedness plan will help ensure patient and staff safety and keep your practice focused on delivering care during an emergency.

For additional guidance, contact the Department of Patient Safety and Risk Management at (800) 421-2368 or by email.