Facilities in Oklahoma, Texas and Arkansas know the drill for severe weather: tornadoes, ice storms, floods and extended power outages are part of the calendar. Emergency plans cover evacuation, supplies and staffing. Fewer plans cover what happens to the technology that holds resident records, supports medication administration and keeps phones working.
An IT disaster recovery plan fills that gap, and it applies whether the cause is a storm, a fire, a failed server or a ransomware attack.
CMS emergency preparedness requirements for long-term care facilities include a plan based on a facility risk assessment, communication procedures, policies for continuity of operations and training and testing. Records and information systems are part of that picture. The HIPAA Security Rule also requires a contingency plan that includes data backup, disaster recovery and emergency mode operation planning.
Good IT planning supports both.
List the systems you need to operate and rank them:
Tier 1, needed immediately: EHR access, nurse call, phones, door controls, internet
Tier 2, needed within a day: email, scheduling, pharmacy connections, eFax
Tier 3, needed within days: billing, payroll, file shares, reporting
This ranking tells you where to spend money and what to restore first.
For each tier, agree on two numbers:
Recovery time objective: how long can it be unavailable?
Recovery point objective: how much recent data can you afford to lose?
Involve clinical and administrative leaders, since these are operational decisions.
Walk through realistic events:
Extended power outage: Do your network closets, phones and nurse call have battery or generator backup? How long do they last?
Tornado or fire damage to the building: Where would operations move? How would staff access systems from another site?
Flooding or water damage in the server or network room: Is equipment off the floor, away from pipes and monitored for leaks and temperature?
Internet outage: Is there a backup circuit or cellular failover?
Ransomware: Are backups protected, and can you rebuild systems from scratch?
Key vendor outage: What do you do if your cloud EHR is unreachable?
Follow the 3-2-1 backup principle with an off-site or cloud copy
Keep at least one copy offline or immutable
Know how long a restore takes, based on actual tests
Store configuration files, license keys, network diagrams and passwords in a protected location that is available if the building is not
Write step-by-step recovery instructions that someone other than your primary IT contact could follow, including:
Contact lists for IT, vendors, carriers, insurers and key staff
Order of restoration
Where to find backups and credentials
How to contact the EHR vendor
Communication templates for staff, families and regulators
Store printed copies off-site or in a place that does not rely on the network.
Downtime procedures and paper forms keep care going while systems are restored. Make sure staff are trained and kits are stocked.
Plans that are never tested fail in surprising ways. At least once a year:
Run a tabletop exercise with the administrator, DON, maintenance, IT and department heads
Test restoring from backup
Review contact lists and system changes
Update the plan after any significant change or real incident
Document each test and the lessons learned. Surveyors and auditors appreciate evidence that the plan is real.
Check what your insurance policies and vendor agreements say about disasters. Does property coverage include equipment and data recovery? Does cyber insurance cover business interruption? Will your vendors provide priority support in a regional emergency? Knowing the answers now avoids unwelcome surprises when time and cash matter most.
On this Thanksgiving, many care teams are working so that residents can enjoy the holiday. Preparing for disruptions is one way to support those teams, so that when something goes wrong, they have a plan instead of a scramble.
UnityCare IT helps facilities develop and test IT disaster recovery plans aligned with emergency preparedness and HIPAA contingency planning, from risk assessment through tabletop exercises.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172