Keeping Your Practice Healthy in the Aftermath of a Disaster

Disasters can be large or small—national or confined to just your practice. Weather-related disasters such as hurricanes along the coasts, blizzards in New England, tornadoes in the Midwest, or mudslides in California can affect your practice if you are in an area inclined to experience such weather patterns. A plane crash, major traffic disaster, or terrorist action can affect the entire healthcare community and emergency response departments. There could be a shortage of vaccine or no known cure for a national health outbreak or threat that affects everyone, such as the enterovirus D68 or Ebola. A disaster can also be a fire or burst pipe that affects only your building or a lost laptop that affects your patients’ confidentiality.

The one thing all disasters have in common for a medical practice is that your practice will be disrupted. How badly and for how long will depend almost as much on your preparedness as on the type of disaster. The goal of your disaster preparedness plan is to ensure that all staff and patients are safely evacuated and/or treated and to restore normal operations as quickly as possible.

That said, ask yourself: “Is my practice prepared to meet disasters of any kind?”

Recent news reports around the world have informed us of the “unknown” respiratory illness affecting children, a spreading Ebola outbreak, hackers accessing major corporate files and celebrity photos, ISIS terrorists, missing planes, hurricanes, fires, floods in the Southwest, and other disasters not expected in particular areas.

It’s time to review your disaster preparedness plan to ensure you are ready to meet any disaster that human actions, Mother Nature, or an office mishap can throw at you. Being prepared for a disaster, large or small, can save lives, information, and your practice.

FIRST STEPS: BUSINESS IMPACT ANAYSIS

Your first step should be to undertake a business impact analysis to find out where your practice is most vulnerable. This analysis should include anything that would affect the operation of your practice.

Determine what disasters could befall your practice. Consider the small accidents that might occur in the office as well as major calamities that would affect the entire community. Prepare a list or spreadsheet addressing the following:

• The possible disasters you could face;

• How likely each is to occur;

• How each could affect your practice and the community; and

• What steps would need to be taken to recover.

Chances are you are more likely to have a computer crash in your office than an airplane crash in your neighborhood. But you should be prepared to meet either scenario.

For instance, a fire could affect your office and records as well as patients and staff if it occurred during office hours. Are you prepared to have everyone exit the building calmly to a designated meeting place? Is there someone (and a back-up) who is responsible for ensuring everyone is out of the office? Are there computer drives, cash boxes, or other easily removed items that should be taken with you? Is there a designated person (and back-up) responsible for that? Are your patient records, accounting information, contacts, and other data backed up and accessible off-site? Is insurance for your equipment, furniture, building, and other assets all up to date? Do you have business interruption coverage? Have you made contingency plans to notify patients and see them at another location?

APPOINT A TEAM

Points to be included in your disaster preparedness plan will depend on the size and type of your practice or organization.

Consider addressing the following questions and assigning tasks to those who are best able to handle each situation; every task should have a back-up person responsible for its fulfillment;

• Who will write the chapter on clinical preparedness for the next disaster in your office policy and procedure manual?

• Who is the bioterrorism specialist for administrative and clinical activities in your practice?

• Who will be the primary contact for the media?

• Who will be the back-up person for each of the above?

• What items, if any, should be removed during an evacuation of the practice, and who is responsible for removing them?

• What resources will be required for the performance of critical processes?

• What training will staff be given to recognize the symptoms of threats such as anthrax, avian flu, Ebola, or nuclear radiation?

• Who will determine that an emergency exists and that the plan should be implemented?

• Who will be responsible for clearing patients safely out of the facility?

• Who will assist patients who have difficulty walking?

• Who will notify staff members who are not at work?

• Who will call patients to reschedule appointments or refer them to another provider?

• Who will deal with the insurance carriers, vendors, and others?

• Who will be the primary contact with the police or fire department?

DEVELOP YOUR DISASTER PREPAREDNESS PLAN

The disaster preparedness plan (aka the business continuity plan) should be part of your written policies and procedures. It should be reviewed and updated annually or whenever there is a significant change in your practice and personnel.

Your plan should be shared with staff and available in more than one place. It does no good if it is in a file cabinet in the office or home and your office or home is inaccessible.

During and after a disaster, communication is vital.

Test your plan. Drills should be run to ensure everyone knows what to do in case of a disaster. At the very least, run through scenarios to determine if everyone knows what to do; what the priorities are; and who is responsible for each task and who the back-up person is. If your community holds mock disaster training, be sure to send at least some of your staff to participate.

Disaster recovery begins with preparedness, so contingency plans for multiple scenarios should be included in your disaster preparedness plan. Include what is absolutely necessary to do and have for various lengths of time. What needs to be done immediately? What needs to be done within 24 hours? What needs to be done if the disaster will affect your business for several days, a week, a month, or longer?

COMMUNICATION

During and after a disaster, communication is vital. Be sure that several key people have the phone numbers, e-mail addresses, and home addresses of all personnel. Include family information and cell phone numbers and even out-of-area relatives who could be contacted. Has a phone tree been established with directions on use (e.g., leave a message but go on to the next name in case your recipient is not available to continue the phone tree)?

Contact information and account numbers for insurance agents, vendors, hospitals, colleagues, and others should be easily accessible outside of the office. Patient records also must be accessible and secure. Once all staff have been contacted, it is important to contact patients. Ideally, office phones can be forwarded to another number. If necessary, a message can be left explaining that the office is closed and expected to reopen on a specific date and/ or that patients are being seen elsewhere.

If the practice has a Web site, a message can be prominently displayed on the site detailing options and how patients can access a physician, nurse, or their records. If there is an e-mail list of patients, a mass notification can be sent (be sure to blind copy the names so they are not revealed to everyone receiving the e-mail).

For large practices and institutions, a spokesperson should be assigned to keep the public aware of what is happening. Assess the public relations scope of the emergency, in consultation with senior management if necessary, and determine the appropriate public relations course of action. In instances where media are notified immediately, due to fire department or police involvement, the spokesperson should proceed to the scene at once to gather initial facts.

Emphasis must be placed on getting pertinent information to the news media as quickly as possible. For major disasters, logs should be kept of all incoming calls and information released to the public. If patients or employees have been injured, be sure to notify families immediately before releasing names to the public.

RECOVERING DATA AND AVOIDING HIPAA VIOLATIONS

Work with your IT systems management team to ensure data are not lost or vulnerable in a disaster and that disrupted systems are quickly restored. All critical files should be secure, backed up, and accessible from anywhere. Assess your current network structure, systems, and back-up

plans. Is there a contingency plan if Internet service or power outages affect the entire area? Are there redundant power supplies on more critical equipment such as firewalls/routers, switches, and file servers?

Data recovery is the most important thing you can do to ensure business continuity following a disaster.

Your first priority should be the safety of patients, personnel, and their families.

For “small” disasters, such as losing a laptop, thumb drive, or smart phone, it is vital that no patient’s protected health information is accessible to anyone else to comply with HIPAA privacy rules. Be sure to have passwords, thumbprints, encryption, or other security measures in place to assure that no unauthorized person can access protected health information.

EVACUATION AND SHELTER-IN-PLACE PLANS

Your first priority should be the safety of patients, personnel, and their families. Have an evacuation plan in case of fire or other disaster that would make your office unsafe. In the event of a “shelter in place” order due to hazards that restrict travel, have your office prepared with survival supplies, such as water, food, personal hygiene supplies, flashlights, portable radio, and batteries. Have cash available in case credit cards and ATMs don’t work.

Encourage your staff and patients, especially those who are on maintenance medications or require oxygen, to create or purchase survival kits for their homes and cars.

FEMA has created a checklist for the public to use during a crisis; see below.

POST-DISASTER RECOVERY

Once a disaster has been met and resolved, it is time to get your practice back on track. Planning for a disaster is the first step in recovering from a disaster. Whether or not you can return to your office is secondary if you have arranged to have your patient records, accounting records, vendor contact information, and other data stored electronically off-site where they can be accessed from any location.

Ideally, you have prearranged with a colleague to temporarily share office space in the event of a disaster that precludes a return to your office.

By determining who will contact staff, patients, vendors, insurance agents, and all other important persons, your post-disaster recovery tasks should be easily started and your practice up and running again quickly.

Have your office phone number forwarded to an answering service or other working number with a message alerting the caller to the disaster and expected date of return to normal. Be sure to let callers know how to reach their physicians or access their medical records.

FEMA Checklist for the Public to Use During a Crisis

• Prescription medications and glasses;

• Infant formula and diapers;

• Matches in a waterproof container;

• Feminine supplies and personal hygiene items;

• Mess kits, paper cups, plates and plastic utensils, paper towels;

• Paper and pencil;

• Books, games, puzzles, or other activities for children;

• Water, one gallon of water per person per day for at least three days, for drinking and sanitation;

• Food, at least a three-day supply of non-perishable food;

• Battery-powered or hand-crank radio and a NOAA weather radio with tone alert and extra batteries for both;

• Flashlight and extra batteries;

• First aid kit;

• Pet food and extra water for your pet;

• Whistle to signal for help;

• Dust mask to help filter contaminated air, and plastic sheeting and duct tape to shelter-in-place;

• Moist towelettes, garbage bags, and plastic ties for personal sanitation;

• Wrench or pliers to turn off utilities;

• Can opener for food (if kit contains canned food); and

• Local maps.

• Important family documents such as copies of insurance policies, identification and bank account records in a waterproof, portable container;

• Cash or traveler’s checks and change;

• Emergency reference material such as a first aid book or information from www.ready.gov;

• Sleeping bag or warm blanket for each person. Consider additional bedding if you live in a cold-weather climate;

• Complete change of clothing including a long sleeved shirt, long pants, and sturdy shoes. Consider additional clothing if you live in a cold-weather climate;

• Household chlorine bleach and medicine dropper. When diluted nine parts water to one part bleach, bleach can be used as a disinfectant. Or in an emergency, you can use it to treat water by using 16 drops of regular household liquid bleach per gallon of water. Do not use scented or color-safe bleach or bleach with added cleaners;

• Fire extinguisher;

Source: www.ready.gov/sites/default/files/documents/files/ checklist_1.pdf.

The time required for recovery of your medical practice depends on the damage caused by the specific disaster. The time frame for recovery can vary from several days to several months. In either case, the recovery process begins immediately after the disaster and takes place in parallel with back-up operations at the designated alternate site. The primary goal is to restore normal operations as soon as possible. You must know and support the key people in your medical building, hospital, and community to manage the backup and recovery efforts and facilitate the support for key business functions and restoration of normal activities. Y

REFERENCE

1. Institute of Medicine. Hospital-based Emergency Care: At the Breaking Point. Washington, DC: National Academies Press, 2007.

*Principal, The Cascardo Consulting Group, and Fellow, New York Academy of Medicine

e-mail: dcascardo@aol.com

This article appeared in The Journal of Medical Practice Management, Jan/Feb, 2015