In Oklahoma, Texas and Arkansas, severe weather is a fact of life. Tornadoes, ice storms, flooding and extended power outages can disrupt a facility's technology as much as its building. Add ransomware, hardware failure and vendor outages, and it becomes clear that every care organization needs a plan for how it will keep operating and how it will restore systems.
IT disaster recovery planning is not just a technical exercise. It ties directly to resident safety, CMS emergency preparedness requirements and the HIPAA Security Rule's contingency plan standard.
CMS requires long-term care facilities to maintain emergency preparedness plans, including risk assessments, policies and procedures, communication plans and training and testing. These plans need to consider continuity of operations and the protection of resident information. Separately, the HIPAA Security Rule requires a contingency plan that includes data backup, disaster recovery and emergency mode operation planning, with testing and revision as addressable items. Aligning these efforts avoids duplicate work.
List the systems your operation relies on, and rank them by how quickly they must be restored:
Tier 1: needed immediately for resident safety, such as the electronic medication record, nurse call, phones and internet.
Tier 2: needed within a day, such as billing, email and scheduling.
Tier 3: can wait longer, such as archives and nonessential tools.
Write down for each system the maximum tolerable downtime and the maximum acceptable data loss. These two targets guide every decision.
Consider what is realistic for your location and building:
Tornadoes, high winds, hail and flooding.
Fire and water damage inside the building.
Extended power loss.
Internet or telecom outages.
Ransomware and other cyberattacks.
Hardware failure and human error.
Vendor or cloud service outages.
Maintain backups following a 3-2-1 approach, with at least one copy offsite or in the cloud.
Store critical equipment above ground level and away from windows and water pipes.
Use uninterruptible power supplies and, where possible, a generator-fed network closet.
Keep spare parts or replacement hardware for key equipment such as firewalls and switches.
Ask cloud vendors for their recovery commitments in writing.
Emergency mode operation means continuing critical functions while systems are down. Prepare:
Paper medication administration records, assessments and care notes.
A printed, regularly refreshed list of residents, medications, allergies, physicians and emergency contacts, handled securely.
Alternative communications, such as cell phones and radios, and contact lists for staff, families and agencies.
Procedures for entering paper records into the system after recovery.
Write step-by-step instructions that a capable person could follow under stress:
Who declares a disaster and who is on the response team.
The order in which systems are restored.
Where credentials, license keys and vendor contacts are stored, including a printed or offline copy.
How to restore from backup, and how to verify that restored systems work.
Where staff will work if the building is unusable.
Decide who tells staff, residents' families, regulators and vendors, and what they will say. Keep contact details for your IT provider, internet carrier, insurer, EHR vendor and pharmacy where you can reach them without the network.
A plan that has never been exercised is a theory. Test it by:
Tabletop exercises that walk leadership through scenarios.
Restoring files and servers from backups.
Downtime drills where units use paper for a short period.
Reviewing and updating the plan after each test, system change or real incident.
Record results, which also helps document compliance.
Backups that have never been restored.
A plan stored only on the server that will be down.
No one clearly in charge.
Contact lists out of date.
Assuming the cloud vendor handles everything.
UnityCare IT helps healthcare and senior-living organizations build and test IT recovery plans that fit alongside their emergency preparedness programs. If your plan has not been reviewed recently, we can help you update it.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172