Your
practice must establish procedures, so your employees know how to obtain
electronically protected health information (ePHI) during an emergency.
Access controls will still be necessary under emergency
conditions, although they may be quite different from those used in normal
operational circumstances. For example, when normal environmental systems,
including electrical power, have been damaged or rendered inoperative due to a
natural or manmade disaster, procedures should be established beforehand to
provide guidance on possible ways to gain access to needed electronic protected
health information.
Follow these tips on how your practice can meet emergency
access requirements: (1) Review your contingency plan to determine what
processes you have in place to provide rapid access to ePHI in an emergency;
(2) Have backup copies of any ePHI that you deem critical; (3) Have a plan to
restore the system and data inside your facility and at an alternative site;
(4) Document the names and roles of individuals with administrative privileges
who can grant access in a crisis.