Healthcare practices must have established procedures in place for employees on how to obtain electronically protected health information (ePHI) during an emergency.
Access controls are still necessary under emergency conditions, although they may be different from those used in normal operational circumstances. For example, in a situation when normal environmental systems, including electrical power, have been severely damaged or rendered inoperative due to a natural or manmade disaster, procedures should be established beforehand to provide guidance on possible ways to gain access to needed ePHI.
Follow these tips on how your practice can meet emergency access requirements:
- Review your contingency plan to determine what processes you have in place to provide rapid access to ePHI in an emergency.
- Have backup copies of any ePHI that you deem critical.
- Have plans to restore the system and data inside your facility and at an alternative site.
- Document the names and roles of individuals with administrative privileges who can grant access in a crisis.