EMR Disaster Recovery Planning

When a disaster occurs, your medical practice must retrieve valuable information through pre-established methods of disaster recovery. Your practice will also have to get back up and running as quickly as possible to ensure business continuity.

Plenty of practices received a test of their preparations when hurricane Katrina struck. The majority of those in the affected area had paper-based record keeping; they are still trying to recover. A few practices were using EMR, or electronic medical records - these had the ability to recover important records and are now much further along the road to recovery.

What, then, is a disaster recovery plan? Well, a good one clearly states what needs to be done, who does it, where it is performed, why, and how a company should react in the case of an incident.

At our practice, we perform daily backups for both the ASC and the practice. This happens at the end of each day during the workweek. The backup copies are next transported by courier to an alternate location, and secured in a disaster-proof container there. When a practice is using this type of system, they aren’t risking the loss of more than a day’s work. Other more advanced (and expensive) solutions add layers of security; online backup services, for example. However, these costly solutions are typically out of the price range of most smaller and medium-sized practices.

Backup systems must be tested periodically to be sure they are working properly. At our practice, we test the backup from the previous day by restoring it to another server used for training purposes. If we discover faults in the training database, we know there’s a problem with the backup system. In addition, backup media (such as tapes) have a limited lifespan, and must be replaced periodically. However, don’t just toss out the old tapes; they must be erased and disposed of properly to ensure the security of your practice’s sensitive information.

Server failure or a lightning strike are far more likely than a hurricane or flood. A good disaster recovery plan uses redundant backup servers running on redundant power sources. What is the plan for business continuity after disaster strikes? It’s important to determine the steps which a practice must take to restore operations, and a proposed timeline for recovery actions.

If your practice has multiple offices, one can take on the functions of the headquarters if rendered inoperable. Important paper documents should be stored in a container that is fire and waterproof. This isn’t a possibility for patient record storage, unfortunately; but irreplaceable documents should be stored in a secure and isolated location. You may want to consider business continuity insurance; this will help with cash flow to pay expenses until revenue is restored. In fact, this type of insurance may spell the difference between financial ruin and recovery for your practice when disaster hits.