Your practice must establish procedures so your employees know how to obtain electronically protected health information (ePHI) during an emergency.
Access controls will still be necessary under emergency conditions, although they may be very different from those used in normal operational circumstances. For example, in a situation when normal environmental systems, including electrical power, have been severely damaged or rendered inoperative due to a natural or manmade disaster, procedures should be established beforehand to provide guidance on possible ways to gain access to needed electronic protected health information.
Follow these tips on how your practice can meet emergency access requirements:
- Review your contingency plan to determine what processes you have in place to provide rapid access to ePHI in an emergency;
- Have backup copies of any ePHI that you deem critical;
- Have plans to restore the system and data inside your facility and at an alternative site; and
- Document the names and roles of individuals with administrative privileges who can grant access in a crisis.