As the past handful of years has taught us, disasters—both man-made and natural—can strike in any place, at any time. If unprepared, a medical practitioner might be forced to close his practice, which could have devastating long-term consequences on the physician, patients and staff members.
A well-crafted disaster plan is critical in ensuring a business’ survival in the aftermath of a catastrophe. Not only does proactively preparing a solid plan put an organization in position to re-emerge from the disaster swiftly, it also enables a practice to attract business from competitors who were not as well prepared.
“Preparing for the worst builds resiliency and provides a competitive edge,” says Aaron Kruger, a consultant with Disaster Preparedness Consulting (disasterconsulting.biz). “Many physicians do not think about continuity planning, so they take longer to reopen following a disruption. If a medical office has a plan, opens sooner and communicates that it’s open, it is possible to gain patients from those offices that remain closed.”
The successful implementation of a disaster plan requires that it be comprehensive, well rehearsed and fluid. Key considerations include: What are your most critical business functions? What types of disasters are you most likely to encounter? How do you establish an emergency communications strategy to ensure that your employees are safe? How will patients’ records be accessed? How will you communicate with your patients to let them know you’re still operational?
Image copyright Thinkstock/Stockbyte.
Take the Offense
“A good offense is always the best defense,” says David Shapiro, managing director of DMS Consulting, a disaster- and recovery-planning firm based in New Orleans (davidmshapiro.com). “In the event of a disaster, many decisions must be made and the task can be overwhelming. Having a plan provides peace of mind and the ability to execute well thought-out decisions during a chaotic time.”
Begin by determining your most critical and time-sensitive business functions. For a medical practitioner, the list might include front desk operations, scheduling, bookkeeping, patient management, records management and supply receiving. Once a list is created, the business functions should be classified as high, medium or low.
Priority ratings, says Gail Moraton, business resiliency manager for the Insurance Institute for Business and Home Safety (disastersafety.org), should be based on the following factors:
• Which functions are crucial to maintain patient care and reputation?
• How much downtime or interruption can each function tolerate?
• Which functions are necessary to fulfill legal and financial obligations?
Next, conduct a threat assessment. Threats, Kruger points out, can generally be broken down into intentional or accidental, as well as human-caused or natural. Human factors can be intentional, such as a terrorist act, or accidental, such as an employee inadvertently deleting a database. Natural events like floods, fires and severe thunderstorms should also be factored into the assessment. Depending on your region, natural disasters such as hurricanes, tornados or earthquakes must be considered as well.
Once a list of critical functions and potential threats has been compiled, it’s time to compare the threats against each function. This exercise is known as a risk assessment. “The goal is to determine what impact a particular threat might have on individual functions and on the business as a whole,” Kruger says. “It’s helpful to consider the likelihood of a threat and measure that against the consequences if it were to occur.”
Upon completion of the risk assessment, it will become clear which protective measures need to be put into place. Next, write a plan that clearly states what needs to be done and who is responsible for each action in the event of a disaster.
Step 1: Review Insurance Coverage
According to Moraton, at least one out of every four businesses that closes because of a disaster never reopens. In some instances, the odds are even lower. Kruger cites New Orleans as an example. “Roughly half of the businesses never reopened following Hurricane Katrina,” he says. “Of those that did reopen, approximately one-third closed within a year due to financial strain.”
Small businesses are especially vulnerable because few have the resources or knowledge to assess disaster risks and spread the risk across several geographic locations. In order to cover the cost of lost income if a facility is forced to shut down temporarily, it’s a good idea to review insurance policies and consider business interruption insurance.
“If a small business owner is concerned about damage or a prolonged shutdown resulting from natural disasters or other types of incidents, having the right type of business interruption policy will protect their assets and give them peace of mind,” says Moraton.
Business interruption insurance compensates a policyholder for income lost during the period of restoration or the time necessary to repair or restore the physical damage to the covered property. Items covered include continuing expenses, the profits a practice would have earned in absence of the disaster, and the salaries of key personnel.
Private practice physicians should also have an alternative vendor arrangement in case a current supplier is affected by a disaster. Ideally, the principal supplier and alternate supplier will be in different geographical locations. Vendors should be required to have their own business continuity plans. The continuity plan, Kruger says, should outline timeframes for resuming operations as well as provide alternatives in the event that the vendor is unable to provide service.
Step 2: Create a Critical Communication Plan
It is important to pre-determine how communication—both internal and external—will be handled in the event of a disaster. During a business interruption, having current telephone numbers, email addresses and emergency contact information for employees, patients, suppliers and other key contacts is critical. The contact information should be available in digital and hard copy format both on the business premises and off.
“The business needs to be able to contact their employees to let them know the status of their business operations, find out their safety, their whereabouts, where and if they should report and what to do about the status of the office,” Moraton says. “Patients, suppliers, vendors and key contacts also will need to be informed about the status of the office.”
Depending on which modes of communication are available during the disaster, parties can be given updates through direct calls, recorded messages on a designated telephone number, texts, emails, Twitter, Facebook or announcements on the practice website.
If there are multiple partners in the practice, it is imperative that each partner be familiar with the emergency preparedness plan and have access to digital copies of the plan in case the office is not accessible.
Step 3: Back Up Patient Records
In the wake of a disaster, it is crucial that data stored on a practice’s network system can be retrieved. To this end, computer data should be backed up on a daily basis and be remotely hosted. Whether it’s patient-based information, loyalty program documentation, accounts receivable or accounts payable, this data is vital to a business’ continued operation.
“In this digital age, backing up data is mission critical,” Kruger says. “I emphasize not only computer backups, but also any smartphones, tablets and other devices where data is stored. I recommend at least two forms of backup: a local copy that is easily accessible and an offsite copy. The latter should be an automated process and located somewhere outside of the immediate geographic location, at least 500 miles away.”
Most EHR vendors store patient records off-site and in multiple geographic locations to protect data against a variety of catastrophic events. Practices that use paper documentation can store backups of their files in off-site locations. A quick Google search for “Paper Medical Records Storage” provides several vendors who offer off-site storage with records readily accessible through email or online databases. Make sure your storage facility—whether paper- or EHR-based—is HIPAA compliant.
Disaster preparedness plans should be reviewed at least once a year. Personnel changes, needs change and technology changes. The last thing you want is to experience a disaster and discover that most of the items in your plan are outdated and no longer relevant.
Your insurance provider may be able to assist your practice in the creation of a comprehensive disaster plan. The Insurance Institute for Business and Home Safety offers an “Open for Business” property protection and recovery planning toolkit to help private practitioners create a disaster plan. The toolkit includes planning worksheets, business continuity and disaster recovery tips, and risk-specific property protection information. It is available at http://disastersafety.org/open-for-business.
Chelan David is a Kansas City-based freelance writer. Contact him at email@example.com.