Disaster planning for healthcare — 4 core CMS elements and more

For Adaugeo Healthcare Solutions, it began when an internet service provider crew running cable in the area severed a main fiber-optic line. During the 72 hours it took to restore communications, the practice had to cancel almost all of its appointments. While Adaugeo relied on its existing preparedness plan, the experience revealed the need for a secondary system and, ultimately, a move to the cloud.

“Any company — whether it has 10 people or 10,000 people — needs to have some sort of disaster recovery plan.”

Guy Jones, IT Support Specialist, Adaugeo

“Any company — whether it has 10 people or 10,000 people — needs to have some sort of disaster recovery plan,” said Guy Jones, IT Support Specialist for Adaugeo. “And you need to adapt to changing situations."

4 elements of emergency disaster management

Creating a preparedness plan can help minimize risk related to a disaster. Such a plan can encourage safety for employees and patients, safeguard protected health information (PHI), and help chart a path to recovery.  

The Centers for Medicare & Medicaid Services (CMS) Emergency Preparedness Rule, which took effect in 2016, offers insight on emergency preparedness for healthcare providers. By identifying requirements, the rule encourages planning for natural and man-made disasters alike.

CMS classifies emergency preparedness guidance into four core elements.

1. Risk assessment and emergency planning 

Determine which hazards are most likely in your local area. Consider the likelihood of interruption to communications, including cyberattacks. Does your healthcare disaster preparedness plan address the potential loss of communication, facilities, or supplies? CMS recommends you review and update your plan at least once a year.

2. Communication plan

Establish a system to connect with staff, providers, and other key contacts. You should coordinate within your practice, as well as with state and local public health departments and emergency management agencies.  

3. Policies and procedures

In general, policies are a set of overarching guidelines to organize your plan, while the procedures outline your approach step by step. As with your communication plan, your policies and procedures should comply with federal and state laws.

4. Training and testing

Your practice should create a training program for employees and be prepared to update it at least once a year. In addition, you can reach out to groups and agencies in the community and tap into their disaster planning resources. You can also coordinate educational efforts with local organizations.

Through dedicated pages, CMS offers emergency preparedness guidance for earthquakes, wildfires, hurricanes, flooding, other severe weather conditions, and more.

Cybercrime: How healthcare providers can prepare

While natural disasters and accidents always pose a threat, cyberattacks are an increasing likelihood for practices. For many years, the threat of cybercrime has been growing in the healthcare industry. In 2020, healthcare topped all industries for average data breach costs — for the tenth year in a row.

Healthcare’s average breach cost in 2020 climbed to $7.13M, up 10.5% from the previous year, according to IBM. Meanwhile, the energy industry and financial industry ranked second and third, with average breach costs of $6.39M and $5.85M respectively.

The COVID-19 pandemic only strained the system further. As businesses went remote, cyber criminals took advantage. For Guy, a key aspect of cybersecurity is training system users.

A computer virus outbreak, Guy said, can often be attributed to a user “doing something that wasn’t planned, was outside protocol, or not paying attention.” The more people use a system, the greater the possibility of security holes.

For this reason, cybersecurity training is essential to your practice’s healthcare disaster preparedness. Read on for five steps you can take to protect patient data in the era of COVID-19.

Enlisting outside resources

Many practices have found support in preparedness and contingency planning from outside vendors. You will want to find out how the vendor will protect your practice and how, in the event of a breach, it would respond.

“Cyberattacks will continue, but security consultants and trusted vendors can help evaluate your practice’s security risk and provide recommendations for improving your company’s defense."

Brian Bobo, Chief Information Security Officer, Greenway Health

“Cyberattacks will continue, but security consultants and trusted vendors can help evaluate your practice’s security risk and provide recommendations for improving your company’s defense,” said Brian Bobo, Greenway’s Chief Information Security Officer.

Read on for additional comments from Brian and nine cybersecurity questions you should ask a prospective vendor.  

When lightning strikes

Disaster planning in healthcare is vital, but how do you build an emergency preparedness plan based on the unknown? Between floods, fires, hurricanes, and hacking, it can be hard to know where to begin to prepare. One simple first step is reflection.

Greenway’s quick readiness assessment can shed light on where you stand. 

“There will be times when something totally wild will happen, like a clinic getting hit by lightning,” Guy said. “Having a plan helps us understand what we will do in those situations.”