Health Information Compliance Alert

Create a contingency plan that will prepare your staff members to handle any disaster.

Don't wait for a worst-case scenario to rip through your facility to think about disaster planning. Give your staff the tools to function during any emergency and teach them to recover from a crisis without losing their cool " or your patients' PHI.

You don't want to bog your staff members down with a separate action plan for each disaster that might come your way, notes Stephen King, an information security specialist with Community Health Network in Wallingford, CT.

"You can rate disasters from full-fledged crises to small-scale events," King says. Then simply educate your team on how to handle each disaster level, he advises. That could cut your training and response times in half, he offers.

Examples: The aftermath of Hurricane Katrina is a disaster but a pipe bursting in a waiting room is a smaller-scale emergency.

Important: There are some things you simply cannot plan for, points out Tom Williams, president of Stony Hill Management in Fredonia, WI. Do this: Develop a disaster plan based on the resources you'll need to recover.

For instance, if a pipe burst in your waiting room, you might have to cancel or reschedule patients' appointments. That cost, along with any other financial investments (including repair and refurbishing expenses), would correlate with one

emergency category. The resources required to recover from a catastrophe like a major hurricane would correlate with a different emergency category.

Dealing with disasters isn't the job for a "one-stop-shop superman," King declares. "Everyone has to work together, or your disaster recovery plan will fail," he contends.

Good idea: Help your staffers see how interdependent they are by asking each one to list his duties within your facility. Next to his duties, ask him to explain how he'd do his job without any outside help. "Explain how each employee's role fits

into a larger chain," King suggests. That will help your staff see the importance of working as a unit rather than by themselves, he says.

"Your information is your most valuable resource; you just can't recover without it," Williams says. You must back up your data and test those backups regularly.

Try this: Coach your disaster recovery or technology team to recover three or four random patients' data each month. That way, if there's a problem with your backups, you'll discover it in time to remedy the issue before a disaster strikes.

Next step: You must store your backup files in a secure location. The worst place to store your backed up information? Your office. Better: Keep your files in a place that's not subject to the same emergencies as your facility.

"You have to consider geographic disasters as well as the random things that everyone experiences," Williams counsels. For a facility in California, earthquakes could affect structures within a large radius, so backups should be sent-to an area

less prone to that type of disaster.

Opportunity: Many vendors offer secure, remote hosting for your backup files. That way, you save the files electronically and the vendor maintains them in a data center thousands of miles away. Good news: Web-based solutions allow you to

access your files from any location with an Internet connection.

Teach -- don't just tell --your staff members what they should do if disaster strikes. "You have to coach them on how to do their specific part of the plan," says Stephen Priest, a consultant with Professor Steve & Associates in New Bedford,

NH. And practice will make perfect. "When there's a disaster, you want your staff to act on instinct rather than just read from a paper," he affirms.

Get your employees ready by simulating a disaster and watching how they respond to it, experts advise. Example: Ask the medical records director to call her key person in the middle of the night. Then ask the key person to produce a telephone

list of key people who must show up to handle a disaster, Priest notes.

Disasters will strike, but you can mitigate any privacy or security breaches by producing documentation that shows you coached your employees on how to respond in a crisis.

Tip: After your staff members go over and agree on a disaster recovery plan, ask them to sign the plan and keep that signature for your records, Priest recommends.