Anyone who has run a care facility in Oklahoma, north Texas or Arkansas knows the routine: watch the radar, move residents to interior hallways, check the generator and hope the storm turns. Severe weather is part of the job. When it passes, the building may be fine but the systems may not be: power may be out, the internet connection may be cut, the server closet may be flooded or the EHR vendor's data center may be unreachable.
IT disaster recovery planning is the part of emergency preparedness that tends to get the least attention. Here is how to give it the attention it deserves.
CMS emergency preparedness requirements for long-term care facilities require a documented program that includes a risk assessment using an all-hazards approach, written policies and procedures, a communication plan, and training and testing. Facilities must review and update their plans and conduct exercises regularly. Information systems and medical documentation are part of what the plan should address, including how you will maintain access to and protect resident records.
The HIPAA Security Rule's contingency plan standard also requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, and calls for testing and revision procedures.
List your critical systems and rank them by how quickly care would be affected without them:
EHR and medication administration records
Nurse call and resident safety systems
Phones and internal communication
Door access and fire alarm monitoring
Internet access and connections to pharmacies and physicians
Billing and payroll, which can often wait a few days
For each, record who depends on it and how long you could operate on paper or alternatives.
Think about the events that actually threaten your location:
Tornado or severe storm damage to the building
Prolonged power outage, ice storms or wildfire
Flooding in server closets or basements
Loss of internet or phone service because of a cut line
Cyberattack that takes systems offline
Loss of a hosted vendor service
Each scenario needs different responses, and a plan that only covers one is incomplete.
Confirm which systems are on generator power and which are on battery backup. Test the transfer under load, not only on paper.
Place uninterruptible power supplies on servers, network equipment and critical workstations, and replace aging batteries on schedule.
Arrange a secondary internet path, such as a cellular or second wired provider, so a single outage does not isolate you.
Keep a few mobile hotspots or cellular devices charged and available for emergencies.
Follow the principle of keeping a copy offsite, ideally with immutable storage. Write down recovery priorities and steps. If your EHR is cloud-based, find out how you would access it during a local outage, and whether you can see a read-only copy of current medication lists and care plans. Keep printed or offline copies of key information, such as census, medication lists, allergies, code status and emergency contacts, and refresh them on a defined schedule.
If you must move residents, records must travel with them. Decide how medication lists and care information are shared with receiving facilities, how you maintain confidentiality during the move and how you restore systems at a temporary site. HIPAA permits disclosures needed for treatment and certain emergency situations, so confirm the approach with your privacy officer in advance.
Assume email and phones may fail. Keep a printed, up-to-date contact list covering staff, family contacts, the IT provider, the EHR vendor, utilities, insurers and emergency management agencies. Establish an out-of-area contact and alternate channels such as text messaging or radios.
A plan nobody has tried is a theory. Include IT scenarios in your annual emergency exercises. For example, run a tabletop exercise in which the server closet is flooded and internet is down, and see who knows what to do. Record what you learned and update the plan.
Backups stored in the same building as the server
Contact lists saved only on a computer that is down
Generators that run lights and HVAC but not the network closet
A plan that lives with one person who may not be on site
No agreement with IT providers for priority response in emergencies
We help care facilities in the region assess IT dependencies, design backups and secondary connectivity, and write the technology portion of their emergency plans. If your plan was written before your last EHR or network change, it is probably time for a review.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172