If 2020 has taught us anything, it is the importance of being prepared for the unexpected. Between the COVID-19 pandemic, the fire season impacting states like Oregon and California, and a busy hurricane season, this has been a remarkable year for organizations to figure out how to plan and prepare for and respond to emergencies and natural disasters.
The following experience is that of HCP's very own Chad Schiffman:
The wrath of Hurricane Sally was unexpected for most of Northwest Florida residents and local businesses, after all, Sally was projected to make landfall in Louisiana or Mississippi. Generally, the west side of a hurricane is the best, and the east side is the "beast" side. Northwest Florida was on the far east side of the storm, so most people only expected a lot of rainfall from Sally.
But with each update, the storm tracked a little bit more east. With each update, the nervousness set in. Was there a chance Hurricane Sally could make landfall in the Panhandle of Florida? Still, throughout the community, the general thought was, "We are fine. Hurricane Sally is not coming in our direction."
Unfortunately, several residents in our community were caught off guard when the eye of Hurricane Sally made landfall the morning of September 16, 2020. It happened to be on the 16th anniversary of Hurricane Ivan, at the same location, in Gulf Shores, Alabama. As the storm slowly worked its way east, leaving destruction all along her path, it became even more apparent that many people were not prepared or did not expect Sally to make landfall where it did.
For example, a construction and development company was replacing an old 3-mile bridge with a new and improved one. One-half of the bridge was finished while they continued to work on the second half. Their company was not prepared for a Category 2 Hurricane, and several of their barges were not secured when Sally made landfall. Many are still missing or turning up in unexpected locations. One of the barges even caused damage to sections of the new half of the 3-mile bridge that now, unfortunately, will need to be replaced entirely. This will cause those who travel between the two cities to use an alternate route for several weeks, adding minutes, if not hours, to their commutes.
This is just one example of not being prepared for the unexpected. So many residents and organizations did not see a possibility of the storm coming in our direction. Last-minute efforts, for most, were not enough to lessen the impact of Hurricane Sally's wrath.
Importance of Emergency Action and Disaster Recovery Plans
Whether it be hurricanes in Florida, Alabama, and other southern regions, or fires in California and Oregon, severe weather and other natural disasters require our attention. Different types of disasters, such as tornadoes, earthquakes, and power outages, can also severely impact your community.
For these reasons, it is crucial for all healthcare organizations to have an Emergency Action Plan and a Disaster Recovery Plan in place, regardless of location. It is imperative to pay close attention to updates and determine if any changes indicate your community and facility are in danger. If so, it is time to activate your plan(s).
Emergency Action Plan
An Emergency Action Plan is typically a written document required under OSHA. Even though smaller organizations (10 or fewer employees) are not required to have a written plan, they are required to communicate it orally to their employees. We highly recommend all healthcare organizations have a written Emergency Action Plan, regardless of their size.
The purpose of the Emergency Action Plan is to facilitate and organize employer and employee actions during workplace emergencies. According to OSHA, a poorly prepared plan likely will lead to a disorganized evacuation or emergency response, resulting in confusion, injury, and property damage.
The elements of an Emergency Action Plan must include, but are not limited to:
- Means of reporting fires and other emergencies
- Evacuation procedures and emergency escape route assignments
- Procedures to be followed by employees who remain to operate critical plant operations before they evacuate
- Procedures to account for all employees after an emergency evacuation has been completed
- Rescue and medical duties for those employees who are to perform them
- Names or job titles of persons who can be contacted for further information or explanation of duties under the plan
At HCP, we also recommend training employees on the different alerts they will hear for different emergencies. These can be broadcast using sirens or even public address systems. It's also important to designate an alternative meeting place in case the primary one is unable to be used or reached because of safety concerns such as fire or explosions.
Disaster Recovery Plan
In the event of a disaster, natural or otherwise, covered entities and their business associates must create and document their Disaster Recovery Plan (DRP) to recover information systems. The DRP is a HIPAA requirement and must be implemented as part of HIPAA policies and procedures, reviewed regularly, and revised as necessary (when changes occur to processes, etc.).
Your DRP must provide a straightforward and structured approach to responding to an unforeseen event that could threaten your organization's information technology (IT) infrastructure (i.e., hardware, software, networks, etc.). Additionally, your DRP must clearly explain:
- Who is responsible for activating the Disaster Recovery Plan.
- How missing data will be restored.
- The process for repairing damaged machines, systems, etc.
- Methods used for ePHI and programs to be restored from the most recent backup (on or off-site).
- The name and contact information for the network administrator and instructions for reaching them, if applicable.
- How copies of missing software licenses will be secured once the organization is up running again.
- The plan is to ensure that all damaged equipment is disposed of properly, including being thoroughly purged of any ePHI and documenting its destruction.
In Summary
More than ever before, Emergency Action Plans and Disaster Recovery Plans are essential for businesses, including healthcare organizations. Being prepared for emergency situations starts with being alert to any potential man-made threats or natural disasters and watching for updates to ensure there is adequate time to activate the plan(s). Having an Emergency Action Plan and Disaster Recovery Plan in place are two important requirements that will help protect your organization's essential operations and reduce the potential for mishandled or lost data.
If this year has taught us anything, it is to be prepared for the unexpected. Taking an approach of "We are fine; it won't happen to us." or "The hurricane doesn't appear to be coming in our direction." could lead to a disorganized evacuation or emergency response, resulting in confusion, injury, property damage, and unretrievable PHI or ePHI.
Have questions about Emergency Action Plans or Disaster Recovery Plans? We can help. Contact us by email: support@hcp.md or reach us by phone: 855-427-0427.