Disaster Planning for Health Information (Updated)

Editor's note: This update supplants the June 2003 practice brief "Disaster Planning for Health Information."

Background

The health record serves a variety of purposes, one of which is to provide an accurate summary of a patient's health status. An unexpected loss of patient health records could be devastating to the patient, organization, and clinical care provider. Therefore, the health record must be guarded against unexpected losses due to a natural disaster. The occurrence of a disaster is rare; however, a well-designed disaster plan and subsequent action plan addressing the re-creation of lost or destroyed patient information will assist organizations in resuming business operations more efficiently and effectively. Every organization must have a comprehensive disaster plan that protects patient safety, secures health information from damage, ensures stability in continuity of care activities, and provides for orderly recovery of information.

The purpose of this brief is to provide guidance in the developmental steps of a facility's disaster plan relative to the collection and protection of health information.

Legal and Accreditation Requirements

HIM professionals can refer to a variety of federal and accreditation requirements when developing a disaster plan. The HIPAA security rule requires health plans, healthcare clearinghouses, and healthcare providers that maintain or transmit health information electronically to provide reasonable and appropriate administrative, technical, and physical safeguards to ensure the integrity and confidentiality of protected health information and protect the information against any reasonably anticipated threats or hazards to its security, integrity, unauthorized use, or disclosure.

The Joint Commission's move to put its emergency management standards into a separate chapter in the Comprehensive Accreditation Manual for Hospitals should serve as a reminder to keep disaster planning in the forefront. Joint Commission standards EM.02.02.13 and EM.02.02.15 set requirements for offering disaster privileges to volunteer licensed independent practitioners and other volunteer practitioners who have some sort of certification (these provisions are currently under the medical staffing and human resource standards).¹ A change in wording under EM.02.02.07 and EP 3 more clearly notes that the emergency operations plan must describe how hospitals will assign staff members to cover essential functions during a disaster response.²

Additional Considerations

Other considerations and additional information may need to be researched and considered before drafting the disaster plan. Research should be based on organizational type and may include the following activities:

Performing a literature search on disasters and disaster planning relative to medical records or health information, including AHIMA's Body of Knowledge at www.ahima.org, as well as other Web sites.
Researching on the Internet to see if other health organizations have posted disaster plans on their Web sites.
Collecting sample health information disaster plans from peers.
Talking to colleagues who have experienced the types of disasters your facility could expect.
Contacting several fire, water, or storm damage restoration companies to determine the services available in your area and obtain any instructional information they can provide. Services may include document, electronic media, and equipment restoration, as well as storage. These companies often can be located in the local telephone directory yellow pages under "fire/water damage restoration" or in the Edwards Disaster Recovery Directory.³ Many of these companies provide nationwide service even if there is no local office listed.
Determining to what extent the facility's insurance covers the costs associated with moving health information, operating elsewhere, recovering damaged information, or lost revenue caused by the inability to restore information. In addition, determine whether your insurer offers consultations and advice about disaster planning. Many insurers provide this at little or no cost to their clients.

Drafting the Plan

Once all necessary requirements and organizational needs are understood, the plan can be drafted. Depending on organizational structure, requirements, and need, various elements will make up organizational policy. Below are some examples that, at a minimum, should be included in the plan:

List the various types of disasters that might directly impair the operation of the facility, such as fire, explosion, tornado, hurricane, flood, earthquake, severe storm, bioterrorism, or extended power failure. See "Sample Disaster Plan Development Checklist."
List your department's core processes. For example, at a large hospital, the core processes might be maintenance of an accurate master patient index (MPI), assembly, deficiency analysis, coding, abstracting, release of information, transcribing dictation, chart tracking, and generating birth certificates.

For each plausible disaster and core process, generate a contingency plan. See "Sample Contingency Plan."

Preparation and Implementation

A plan is only as strong as the people who execute it. A documented, finalized, and approved disaster recovery plan must be implemented, tested, and reviewed with all staff to ensure its overall compliance and success. Besides training, performing test runs of the plan is imperative in identifying gaps and any needed enhancements or changes. Listed below are some useful tips for implementation.

Perform the preparatory activities listed in each of the contingency plans (examples of these activities are listed below).
Share the preliminary plans with the appropriate organizational committee. Develop written agreements with potential disaster recovery vendors or alternative service providers and locations as needed.
Provide staff with the training and tools necessary to implement the plan. See "Sample Staff Competency List."
Test the plan. Retest the plan.
Reevaluate and revise the plan and corresponding procedures based on the results of testing and simulated disaster trials. Input should be collected from all staff, including the safety officer, risk manager, and privacy and security officials.
Include disaster training as part of staff orientation.
Measure staff competency by asking staff to describe or demonstrate their roles and responsibilities during specific disasters. Include competencies in staff performance standards.
Establish a plan for:

Conducting drills
Reviewing and updating the plan
Staff training and review
Planning execution and enforcement

Restoring Damaged Records

In the event equipment or records are damaged in an actual disaster, contact fire, water, or storm damage restoration companies and consider electronic data recovery companies, where applicable. Contracts for damage restoration services must provide that the services will be performed in accordance with the HIPAA privacy and security rules for business associates. The contract should specify:

Method of recovery
Nonuse or further disclosure of the information other than as permitted or required by the contract
Use of appropriate safeguards to prevent use or disclosure of the information other than as provided for by the contract
Reporting to the contracting entity any inappropriate use or disclosure of the information of which it becomes aware
Ensuring that any subcontractors or agents with access to the information agree to the same restrictions and conditions
Indemnification the healthcare facility from loss due to unauthorized disclosure
Return of the information at the termination of the contract or provision of a certificate of its destruction and assurance that the contractor retains no copies
Time that will elapse between acquisition and return of information and/or equipment
Authorization of the contracting entity to terminate the contract if the business partner violates any material term of the contract

To the extent records cannot be reconstructed by means of either electronic data recovery or through a damage restoration company, perform the following tasks to reconstruct as much data as possible:

Reprint or upload data and documents from any undamaged databases, such as admission, transcription, laboratory, and radiology databases or data backup services
Retranscribe documents from the dictation system
Obtain copies from recipients of previously distributed copies, such as physicians' offices, other healthcare facilities, or the business office

If you are unable to reconstruct part or all of a patient's health information, document the date, the information lost, and the event precipitating the loss in the patient's record.

Post-disaster Auditing, Control, and Maintenance

Once a disaster strikes and the disaster response plan is executed, post-disaster management is crucial. Documentation is a key final step in any disaster plan. The facility must prepare a detailed record of the disaster event that includes at minimum a list of patient records affected, recovery efforts taken, and outcomes. Reconstruction of information must be documented, including the method used, and the entry must be authenticated according to the facility's policy. Organizations also may choose to maintain a log of lost or destroyed records, which will allow for easy retrieval of general information regarding the past event should any legal or accreditation issues arise.

If a facility discloses patient information that has portions missing or reconstructed due to a disaster, it must include with the record a copy of the entry documenting the loss or reconstruction.

Another key step to post-disaster management is to meet with staff and communicate. Staff should be given the opportunity to provide input to help evaluate departmental performance and identify opportunities for improvement. Most importantly, staff may need to be allowed time for the grieving and healing process that follows emotionally charged disasters.

The loss of health information can cause delays in patient care, missed medications, or numerous other healthcare crises. Supporting the continuum of care and providing a longitudinal record that can follow a patient throughout the course of his or her life is important to every organization. By appropriately planning in advance for disaster, organizations can mitigate potential healthcare concerns and provide patients with valuable information in the aftermath of a disaster.

Notes

1. Joint Commission. "Standard EC.02.02.13 and EC.02.02.15." In 2009 Comprehensive Accreditation Manual for Hospitals. Oak Brook, IL: Joint Commission, 2009.

2. HCPro. "2009 Joint Commission Standards Keep Focus on Disaster Planning: Emergency Management Alert." Emergency Management Alert July 22, 2008. Available online at www.hcpro.com/SAF-215488-877/2009-Joint-Commission-standards-keep-focus-on-disaster-planning.html.

3. Lewis, Steven. Edwards Disaster Recovery Directory. 18th ed. Newton, MA: The Systems Audit Group, 2009–2010.

Sample Disaster Plan Development Checklist
Major Function	Extended Power Outage	Fire	Flood	Hurricane	Explosion
1. MPI
2. Assembly
3. Deficiency analysis
4. Coding
5. Abstracting
6. Release of information
7. Transcription of dictation
8. Chart tracking, location, and provision
9. Birth certificates
For each plausible disaster and major function, develop a contingency plan. As plans are completed, place a check mark in the corresponding box.

Sample Contingency Plan 1. Facility name: 2. Department name: 3. Plan originator: 4. Date: 5. Major function: Maintenance of an accurate MPI 6. Disaster: Extended power outage 7. Assumptions: An ice storm has resulted in an extended power outage. Most staff members are able to report to work. 8. Existing process detail: The MPI is generated through entries made by registration and admitting staff and contains detailed patient information, including the patient's name and medical record number. When a patient is registered, the admitting and registration staff access the MPI to determine whether the patient already has a medical record number or whether a new number must be generated. HIM staff also may access the MPI for various functions, such as when they need a medical record number to pull medical records for a current hospitalization, to accompany a bill for payment, for continuing care, for quality monitoring or legal action, and to number documents for placement in the paper record. The accuracy of the numbers assigned is verified by HIM. 9. If/then scenarios: If admitting and registration staff do not have access to the MPI when registering a patient, then the following might result: the registration system or registrars will assign new numbers, creating duplicates that may cost $20 per set to correct, or the registrars will issue no numbers and patient health information will have to be matched to patients by using account numbers, admission or discharge dates, or birth dates. Medical record numbers will have to be assigned and entered into the database at a later date. If HIM staff members do not have access to an MPI, then record retrieval for patient care and other healthcare-related purposes cannot occur. 10. Interdependencies: Registration staff, patient care areas, transcription, billing, and external customers, including patients, third-party payers, attorneys, and regulatory agencies, need the medical records, so a functional MPI is required.
Contingency Plan Solutions and Alternatives
Potential Solutions/Alternatives	Limitations	Benefits
Auxiliary power will be used to access an electronic copy of the MPI on disk	MPI won't work without auxiliary power The process is cumbersome This process will likely generate some duplicate medical record numbers It is costly for human resources to correct duplicate numbers	Admitting staff are accustomed to this process Process produces fewer duplicates than with no back-up system Process is less cumbersome than a totally manual system
Staff members will have to depend on a paper MPI	Printouts will be cumbersome Printouts probably will be located in HIM The process will likely generate duplicate or no numbers It is costly for human resources to use manual system and correct duplicate numbers	Process provides a mechanism to look up a patient's number and pull a chart when critical
Contingency Plan Tasks to be Performed for Selected Alternatives (before, during, and after disaster)
Activity		Responsibility
Verify availability of MPI on disk		Associate director, HIM
Implement processes to update disk daily		Associate director, HIM
Develop contingency plan procedures and training materials		Associate director, HIM
Train admitting and registration and HIM staff to use contingency plan		Associate director, HIM
Use post-disaster and implementation contingency plan		Data quality coordinator, HIM
Schedule production and delivery of paper MPI routinely		Associate director, HIM
Create contingency procedures and training materials for manual system		Associate director, HIM
Develop schedule to update contingency plan and training materials		Associate director, HIM
Contact List		Phone number
HIM director
HIM assistant director or managers
HIM staff members (list each name separately)

Sample Staff Competency List Facility Name Health Information Disaster Plan Staff Competency Checklist Staff member name:_______________________________ Date:___________________
	Yes	No
1. Staff member demonstrates familiarity with the disaster manual by quickly locating various disaster protocols and emergency phone numbers.
2. For each plausible disaster type, staff member accurately verbalizes the contingency plan.
3. For each plausible disaster type, staff member accurately verbalizes or demonstrates his or her own responsibilities.
4. Staff member can articulate methods of protecting people, health information, and equipment from damage.
5. Staff member accurately verbalizes transportation and storage options for relocating equipment and health information.

Prepared By

Patricia Cunningham, MS, RHIA

Acknowledgments

Jill Clark, MBA, RHIA
Angela K. Dinh, MHA, RHIA, CHPS
Mary Stanfill, MBI, RHIA, CCS, CCS-P, FAHIMA
Allison Viola, MBA, RHIA
Diana Warner, MS, RHIA, CHPS
Lou Ann Wiedemann, MS, RHIA, CPEHR

Prepared By (original)

Jill Burrington-Brown, MS, RHIA
Gwen Hughes, RHIA

Acknowledgments (original)

Beth Hjort, RHIA, CHP
Harry Rhodes, MBA, RHIA, CHP
Melva Visher, MA, RHIA

Article citation:
AHIMA. "Disaster Planning for Health Information (Updated)." (Updated December 2010).