Keeping Your Practice Healthy While Saving Lives

An executive summary published by the National Academy of Sciences defines a disaster as “an event that creates a significant, short-term spike in the demand for emergency care services requiring extraordinary measures.”(1)

Recent news reports around the world have informed us of hackers accessing major corporate files and celebrity photos, active shooters, ISIS terrorists, missing planes, hurricanes, fires, floods and other disasters not expected in a particular area. Disasters can be large or small, national or confined to just your practice. Weather-related disasters such as hurricanes along the coasts, blizzards in New England, tornadoes in the Midwest, or mudslides in California can affect your practice if you are in an area inclined to experience such weather patterns. A plane crash, major traffic disaster, or terrorist action can affect the entire community and emergency response departments. A disaster can also be a fire or burst pipe that affects only your building, accidental deletion of a critical file, or a lost laptop that affects your clients’ confidentiality.

Odds are that sooner or later, your practice will experience some type of disaster. You don’t know what will actually happen or when; how long it will last; how widespread it will be; or how it will impact your practice, patients or employees. The one thing all disasters have in common is that your practice will be disrupted. How badly and for how long will depend on your preparedness almost as much as the type of disaster. The goal of your Disaster Preparedness Plan is to ensure that all staff and patients are safely evacuated and to restore operations as quickly as possible.

The one thing you should know, however, is that you need to plan for it. That said, ask yourself: Is my practice prepared to meet disasters of any kind?

Now is the time to review your disaster preparedness plan to ensure you are ready to meet any disaster man, Mother Nature, or an office mishap can throw at you. Being prepared for a disaster—large or small—can save lives, information, and your practice.

First Steps: Business Impact Analysis

Your first step should be to undertake a “business impact analysis” to find out where your practice is most vulnerable. This analysis would include anything that could affect the operation of your practice.

Determine what disasters could befall your practice. Consider the small accidents that might occur in the office as well as major calamities that would affect the entire community. Prepare a list or spreadsheet of the possible disasters you could face; how likely each is; how each could affect your practice and the community; and what steps would need to be taken to recover.

You are more likely to have a computer crash in your office than an airplane crash in your neighborhood. But you should be prepared to meet either scenario.

Chances are you are more likely to have a computer crash in your office than an airplane crash in your neighborhood. But you should be prepared to meet either scenario.

For instance, a fire could affect your office and records as well as clients and staff if during office hours. Are you prepared to calmly have everyone exit the building to a designated meeting place? Is someone (and a backup) responsible for ensuring everyone is out of the office? Are there computer drives, cash boxes, or other easily removed items that should be taken with you? Is there a designated person (and backup) responsible for that? Are your records, accounting information, contacts, and other data backed up and accessible off-site? Is insurance for your equipment, furniture, building, and anything else up to date? Do you have business interruption coverage? Have you made contingency plans to notify patients? Have you made reciprocal plans with another practice to see patients if one office is closed and the other is open?

Appoint a Team

Points to be included in your disaster preparedness plan depend on the size and type of your practice/organization. Consider addressing the following questions and assigning tasks to those who are best able to handle each situation. Every task should have a back-up person responsible for its fulfillment.

• Who will write the chapter on preparedness for the next disaster in your office policy and procedure manual?

• Who will determine that an emergency exists and that the plan should be implemented?

• Who will be responsible for clearing patients, customers, and personnel safely out of the facility?

• Who will assist those who have difficulty walking?

• Who will notify staff members who are not at work?

• Who will call patients to reschedule appointments?

• Who will deal with the insurance carriers, vendors, and others?

• Who will be the primary contact with the police or fire department?

• Who will be the primary contact for the media?

• Who will be the back-up person for each of the above?

• What items, if any, should be removed during an evacuation of the practice, and who is responsible for removing them?

• What resources will be required for the performance of critical processes?

Develop Your Disaster Preparedness/Business Continuity Plan

The disaster preparedness plan (also known as a practice continuity plan) should be part of your written policies and procedures. It should be reviewed and updated annually, or earlier if there is a significant change in your practice and personnel.

Comprehensive disaster planning includes a blueprint for how to continue uninterrupted or minimally affected operations during a disaster and disaster recovery (i.e., how to restore operations and recover from a disaster that exceeds the protections afforded by the business continuity measures).

Disaster recovery begins with preparedness.

Your plan should be shared with staff and available in more than one place. It does no good if it is in a file cabinet in the office or home and your office or home is inaccessible.

Test your plan. Drills should be run to ensure everyone knows what to do in case of a disaster. At the very least, run through scenarios to determine whether everyone knows what to do, what the priorities are, and who is responsible for each task and who the back-up person is. If your community holds mock disaster training, be sure to send at least some of your staff to participate.

Disaster recovery begins with preparedness, so contingency plans for multiple scenarios should be included in your disaster preparedness plan. Include what is absolutely necessary to do and have for various lengths of time. What needs to be done immediately? What needs to be done within 24 hours? What needs to be done if the disaster will affect your practice for several days, a week, a month, or longer?

Communication

During and after a disaster, communication is vital. Be sure that several key people have the phone numbers, e-mails, and addresses of all personnel. Include family information and cellphone numbers and even out-of-area relatives who could be contacted. Has a phone tree been established with directions on use (e.g., leave a message but go on to the next name in case your recipient is not available to continue the phone tree)?

Contact information and account numbers for persons such as insurance agents, vendors, and colleagues should be easily accessible outside of the office. Records must also be accessible and secure, either in the cloud or regularly backed up and stored elsewhere.

Once all staff have been contacted, it is important to contact patients. Ideally, office phones can be forwarded to another number. If necessary, a message can be left explaining that the office is closed and expected to reopen on a specific date or specifying any contingency plans until then. If the practice has a website, a message can be prominently displayed on the site detailing options and how patients can access someone and/or their records. If there is an e-mail list of patients, a mass notification can be sent (be sure to blind copy the names so they are not revealed to everyone receiving the e-mail).

Large practices and institutions should assign a spokesperson to keep the public aware of what is happening. Assess the public relations scope of the emergency, in consultation with senior management if necessary, and determine the appropriate public relations course of action. In instances where media are notified immediately, due to fire department or police involvement, the spokesperson should proceed to the scene at once to gather initial facts. Emphasis must be placed upon getting pertinent information to the news media as quickly as possible. For major disasters, logs should be kept of all incoming calls and information released to the public. If patients or employees have been injured, be sure to notify families immediately and before releasing names to the public.

Recovering Data

Work with your IT systems management team to ensure data will not be lost or vulnerable in a disaster and that disrupted systems are quickly restored. All critical files should be secure, backed-up, and accessible from anywhere. Assess your current network structure, systems, and back-up plans. Is there a contingency plan if Internet service or power outages affect the entire area? Are there redundant power supplies on more critical equipment such as firewalls/routers, switches, and file servers?

Data recovery is the most important thing you can do to ensure practice continuity following a disaster. For “small” disasters such as losing a laptop, thumb drive, or smart phone, it is vital that any patient information is inaccessible to others to assure privacy. Be sure to have passwords, thumbprints, encryption, or other security measures in place to ensure that no unauthorized person can access this information.

Evacuation and Shelter-in-place Plans

Your first priority should be the safety of patients, personnel, and their families. Have an evacuation plan in case of fire or other disaster that would make your office unsafe. In the event of a shelter-in-place order due to hazards that restrict travel, have your office prepared with survival supplies—water, food, personal hygiene supplies, flashlights, portable radio, batteries, and so on. Have cash available in case credit cards and ATMs don’t work.

Encourage your staff and patients, to create or purchase survival kits for their homes and cars.

FEMA has created a checklist for the public to use during a crisis. It is available at www.ready.gov/build-a-kit and is reprinted, in part, in the sidebar “FEMA Checklist for the Public to use During a Crisis.”

Post-Disaster Recovery

Once a disaster has been met and resolved, it is time to get your practice back on track. Planning for a disaster is the first step in recovering from a disaster. Whether or not you can return to your office is irrelevant if you have arranged to have your patient records, accounting records, vendor contact information, and other data stored electronically off-site where they can be accessed from any location.

Ideally, you have prearranged with a colleague to temporarily share office space in the event of a disaster that precludes a return to your office.

By determining who will contact staff, patients, vendors, insurance agents, etc., your post-disaster recovery tasks should be easily started and your practice up and running again quickly.

Have your office phone number forwarded to an answering service or other working number with a message alerting the caller to the disaster and expected date of return to normal. Be sure to let callers know how to reach doctors, nurses, or alternate personnel, and/or how to access their records.

The time required for your practice to recover depends on the damage caused by the specific disaster. The timeframe for recovery can vary from several days to several months. In either case, the recovery process begins immediately after the disaster and takes place in parallel with back-up operations at the designated alternate site. The primary goal is to restore normal operations as soon as possible. You must know and support the key people in your building and community to manage the backup and recovery efforts and facilitate the support for key business functions and restoration of normal activities.

Summary

The best time to plan for a disaster is before a disaster occurs. Develop a disaster preparedness plan as part of your written policies and procedures. This is mandatory under CMS (see the sidebar “Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers”).

Ensure that all data are backed up and accessible outside of the office. Identify and communicate meeting places, phone call chains, and alternate work facilities. Determine who is authorized to declare a disaster. Train your staff on what to do during a disaster. Conduct drills and role-playing to test your procedures in different scenarios.

Consider enlisting the assistance of a professional to assist with the development of a formal disaster preparedness plan, preferably a professional who is not selling a predefined solution.

Developing a plan that is specific to your practice needs will not prevent a disaster, but it can significantly reduce the impact of a disaster on your ability to remain in business.

Reference

1. Institute of Medicine. Hospital-based Emergency Care: At the Breaking Point. Washington, DC: National Academies Press, 2007.

FEMA Checklist for the Public to Use During a Crisis

• Prescription medications and glasses

• Infant formula and diapers

• Pet food and extra water for your pet

• Important family documents, such as copies of insurance policies, identification, and bank account records in a waterproof, portable container

• Cash or traveler’s checks and change

• Emergency reference material such as a first aid book or information from www.ready.gov

• Sleeping bag or warm blanket for each person. Consider additional bedding if you live in a cold-weather climate.

• Complete change of clothing including a long-sleeved shirt, long pants, and sturdy shoes. Consider additional clothing if you live in a cold-weather climate.

• Household chlorine bleach and medicine dropper: when diluted nine parts water to one part bleach, bleach can be used as a disinfectant. Or in an emergency, you can use it to treat water by using 16 drops of regular household liquid bleach per gallon of water. Do not use scented, color safe, or bleaches with added cleaners.

• Fire extinguisher

• Matches in a waterproof container

• Feminine supplies and personal hygiene items

• Mess kits, paper cups, plates and plastic utensils, paper towels

• Paper and pencil

• Books, games, puzzles, or other activities for children

• Water: one gallon of water per person per day for at least three days, for drinking and sanitation

• Food: at least a three-day supply of nonperishable food

• Battery-powered or hand=crank radio and a NOAA weather radio with tone alert and extra batteries for both

• Flashlight and extra batteries

• First aid kit

• Whistle to signal for help

• Dust mask, to help filter contaminated air, and plastic sheeting and duct tape to shelter-in-place

• Moist towelettes, garbage bags, and plastic ties for personal sanitation

• Wrench or pliers to turn off utilities

• Can opener for food (if kit contains canned food)

• Local maps

Source: Build a Kit. www.ready.gov/build-a-kit .

Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers

If you have a practice that accepts Medicare and Medicaid, then these final rules apply to you.

Final rules address three main areas:

1. Safe-guarding human resources;

2. Maintaining business continuity; and

3. Protecting physical resources.

You will need to develop and implement policies and procedures that support risk assessment, the emergency plan, and the communications plan. These policies will ensure that you have a system in place to track all on-duty staff and sheltered patients/clients during and after a crisis event.

• Mandatory disaster plan: Each practice must develop and maintain an emergency communication plan that complies with state and federal law incorporating contact information for all providers. Assurance must be made that the method of sharing information and medical documentation between providers is in accordance with HIPAA and all pertinent rules. Attention should be given to patient care/occupancy and transportation of patients.

• Training and testing: You must develop and maintain a training and testing program for all new and existing employees. All employees must demonstrate knowledge of the emergency facility, or a community-based exercise must occur. An additional exercise of the facility’s choice also must be included annually.

• Noncompliance: No exception will be granted to the requirements of CMS. Penalties for noncompliance will follow the same process of noncompliance as with any other conditions of participation and conditions for coverage.

For more detailed information, consult the Emergency Preparedness Rule published by the CMS.(1)

Reference

1. Emergency Preparedness Rule. www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/Emergency-Prep-Rule.html .