Episode 067: Putting Disaster Plans In Place

Speaker 1: You are listening to Your Practice Made Perfect. Support, protection, and advice for practicing medical professionals brought to you by SVMIC.

Brian: Hello, thanks for joining us today. My name is Brian Fortenberry and in this episode of our podcast, we are going to be talking about disaster preparedness. Something that's going to be exciting, I'm certain we all love to embrace disaster, right Rana?

Rana: Right? Yeah, sure.

Brian: Joining me to discuss this today is Rana Mcspend. Thanks for being here.

Rana: Thank you.

Brian: So before we get into talking about the wonderful world of disasters, tell us a little bit about yourself and your time at SVMIC.

Rana: Well, I've been at SVMIC for the last seven years. I've enjoyed every minute of it. Prior to coming to SVMIC, I was a practice manager for four years and before that I worked up through the ranks over the past 20+ years. So, I've been in medical business for over 20 years. I'm a fellow at through MGMA. I am a certified professional coder. I belong to the Tennessee and GMA local chapters. I'm all about medical management.

Brian: That's fantastic. So you're really going to be able to help us today to understand a little bit more, because this is something that really is important.

Rana: It really is.

Brian: That medical groups need to understand, right?

Rana: So many groups do not have any kind of disaster preparedness already. So, when something happens, it just goes to heck in a handbasket.

Brian: So, whatever we start talking about disaster from the perspective of the medical practice, what exactly are we talking about?

Rana: Well, a disaster really is anything that puts you out of business for 24 hours or more. You can't see patients, you're not able to do what you need to be doing. So, generally, when we think of disasters, we think of the large things: tornadoes, floods, fire. But there can be small things too: your computer system crashing.

Brian: That's exactly what I thought.

Rana: Yes. The power going out, your Internet being cut the next town over. If you can't access your records, that's a disaster.

Brian: The first thing I thought of is some type of potential cyber attack or even the power went out or just a variety of issues that you might not even one have access to the building or two have access to any of your records or your data.

Rana: Exactly.

Brian: So why do groups need to have a disaster plan in place really? I mean obviously you have to be able to get through the disaster, but why is the need for this?

Rana: Well, the real need is because in a disaster we still have an obligation to our patients and our staff. These people are depending on us to be there for them, for their needs. And if we're not able to get through the disaster ourselves, we can't be there for them. And so the biggest thing is to also have an organized plan on how you're going to make it through this. Cause the last thing you want to be doing is running around like a chicken with your head cut off trying to figure out how I'm going to get this, what do I need to get there? And then get to the end and realize, oh I forgot a humongous thing.

Brian: If you're waiting till the point that the disaster happens, you're in such a panic state I would imagine that, one, you're not making well thought out decisions at that point.

Rana: Exactly.

Brian: And number two, like you said, you may not even have what you need just to get through. So how does a group go about preparing for disaster? What does a disaster plan look like? How they develop that?

Rana: Well, one of the first things and group needs to do is develop a disaster team. Of course, the size of the team is going to be dependent on the size of the group. Of course, larger groups have more employees that do you can pull from and smaller groups aren't going to have that many employees but reality it should be a mixture of different types of employees have some administrative staff in there, has some clinical staff in their billing staff. That way they have perspective on things that the manager might not necessarily have eyes on or understand what they need to get in order to get back to 100% fully operational.

Brian: You probably need someone to represent every part of the clinic. You need to be able to touch every part to know how this affects them, right?.

Rana: Absolutely, yes.

Brian: So, if you're in the process of trying to develop this on a team basis, do you bring them all in at one time to lay it all out? How have you walked people through this plan process?

Rana: It's going to be, again, depending on the group, it wouldn't hurt to meet as one group together. Start throwing things around and then as things progress and only meet with certain sections.

Brian: I got ya. So is the first part of that group looking at what the vulnerabilities might be? Or what the issues could potentially be? What is their first charge really as a team?

Rana: So as a team, the first charge is to look at what your vulnerabilities are. So you're going to be looking at your external vulnerabilities and your internal. So external are those big things we say like the community things, things that affect everybody in the community, the tornadoes, forest fires or brush fires. This floods that come through that wipe out everybody. You don't have as much control over those types of things. And also even need to think about the type of area you are in. Certain groups might have external vulnerabilities that others wouldn't, such as if your group is close to a nuclear power plant or close to a fault line, you're going to be thinking more along the lines of what happens if we have a nuclear meltdown and how we'd escape if you're close to the nuclear power plant or if you're close to the fault line, what are we going to do in the event of an earthquake?

Brian: That makes sense so a disaster preparedness for a group say in Memphis near a fault line might be different than East Tennessee near the nuclear power point. This is what you're saying. So you just have to look at what could affect and then of course there's like tornadoes or wildfires or things like that, that could affect anybody. So you just have to be prepared for it.

So, Rana what we're talking about, assessing our vulnerabilities, this external versus internal vulnerabilities. What's the difference? Why is that important and can you expound on that?

Rana: Absolutely. So external vulnerabilities are everything that hits the community. So, tornadoes, floods, huge fires, like the brush fires that are happening in California or even what we had happen in Gatlinburg a few years ago. But internal vulnerabilities are those things that hit your practice only. So, cyber crime, ransomware, workplace violence, power outages, Internet being cut, that kind of stuff. So, that's a really huge difference between an external internal vulnerabilities. How many people does it affect? Of course, you're going to have plans for each type of vulnerability that you have. You're going to react to a brush fire a little bit differently than you may to an internal fire.

Brian: I would think, too, when it is something external that is big enough to involve the entire community. Say a big storm floods, tornadoes, brush fires, like in Gatlinburg, that's going to impact a lot of different people. And so their expectation may be of your clinic might be different than if it's just an internal issue and everything else in the world is okay, they show up and they can't get the services they need.

Rana: Correct. If a big external thing happens, a tornado comes and wipes out half the community. They know that you're building is probably not going to be standing there but if patient comes in and you've lost your Internet connection for the day and you can't access any of your records, they don't care. They're there to see you as the doctor and they want their care. So that's why you need to have backup plans for all this kind of stuff, how you're going to get through this disaster.

Brian: And I would think just thinking about from a layman's standpoint, I probably need to make real sure that I have these internal things taken care of for sure. Because healthcare has become such a customer experience now, a patient experience and how they rate you and their expectations of good care, that they may be more understanding of an external vulnerability than an internal. So we really need to look and design things that we can at least stay functional.

Rana: Yes. Because again, our patients don't care that we're suffering an internal disaster they are there to get their care. The building's still there. All the staff is still here, well, why can't you see me? I don't care that you can't get my record, still, you need to see me.

Brian: I'm still sick. I've heard the term reverse planning. What is that and what does that mean?

Rana: So, reverse planning is you see the ultimate goal. What do you need in order to get up and running again and then deciding, okay, so our ultimate goal is to be here. Let's say my server crashed today. What do I need to be 100% operational? Well, the first thing I need is I'm going to have to have a server. So, think back. Where am I going to go get a server? Who do I need to contact for that? Now, once I have the hardware in place, what software do I need to have loaded on there? And then once I get the software loaded on, well then I need to go in and get my backup.

So, is this all something that I can handle myself or do I need to bring in somebody outside to do it? If I'm not comfortable doing it myself, who is my IT person? Who is my IT company? Do I have somebody in our company that does IT? So, who do I need to be involved in this situation? So that's all what the reverse planning is it gets you your ultimate goal and you start reversing back to think, what do I need in order to get to that ultimate goal?

Brian: So, that is definitely something that you look at when it comes to disaster preparedness?

Rana: Yes.

Brian: What are some steps that you and SVMIC help policyholders practices, what are some of the things that you do to help people through this process?

Rana: We're currently developing a disaster plan checklist, so hopefully that'll be up on our website in the next few months and available for our policyholders. The one of the first things we recommend is that the group sit down and just look at what those external, internal vulnerabilities are. Of course, internal is going to be your power outages, workplace violence, that kind of thing. What is the likelihood of this risk happening? There's a much higher risk of the electricity going out or your server being compromised than there is of a fire. The electricity going out is more likely than the fire, but both can be equally as damaging because if you're not able to get your records period, then you've got a problem. So, it's the same. Then after that, go through and decide which of these vulnerabilities do we need to address first? Which is most likely to happen and be the most damaging for us?

And then develop the plan for that particular vulnerability and then go down the list from there. Now, unfortunately, you're not going to be able to think of all the vulnerabilities that can hit you until they actually hit you, but hopefully if you already have plans in place for a certain vulnerabilities, you can take portions of that plan to address it for what you're currently facing.

Brian: Do most practices have a disaster plan in place or is this something that kind of gets lost in the shuffle with the crazy world of healthcare these days?

Rana: Unfortunately, this is one of those back burner things that never actually gets addressed until it's too late. Now is really the time to address it when you think about it, when you have some time to do so. Unfortunately, most medical practices, you never have time to do these things, but you've got to make the time to do this. Because, again, you don't want to be facing your entire building being destroyed by a tornado and not knowing what to do at this point. That's too late. You need to have something already in place. So take the time to do this.

Brian: So if you had a group that have not done any type of disaster preparedness at all, and they're in the infancy stage of this and just trying to find out where to start, they haven't gotten their team together, they have done nothing. Where do they start? Where’re the baby steps to get going in their plan?

Rana: Addressing what vulnerabilities they immediately think of. Making a list of those vulnerabilities and then talk out, what do we need for this? And then as you're talking it out, write it down, record it. Once you get done recording everything, look back through it. Does it still make sense? Did we leave out a step? Did we think about something on the back end that, oh wait, we needed to put this in here too. So, you're constantly revising it as well. And practice some of it just like you do a fire drill. Practice, because you might not realize that you're forgetting a step until you actually go to do it.

Or you might realize, hey, this step that we put in there is redundant or we don't need it, or it is too cumbersome. We need to address this. So, always revising this and then teach it. Teach it to all your staff because they need to be aware of what they need to do. You might have one staff member that needs to contact all the other staff members. Hey, the building has just been destroyed. We're meeting at x place. This is where we're setting up our emergency clinic.

Brian: I instantly think about like at airports or hospitals, often they will have these disaster drills, almost simulations. Is that a good practice to do? Like a simulation?

Rana: Absolutely. Yeah. If you can do a live simulation, that's the best because then you're actually doing the actions. You're going through the actual actions to do so. But if you can't do a physical emergency plan, then actually just sit down and talk it through. So the person who's in charge of this, they say, I call the other employees. Then what's the next step? And then that person who's in charge of the next step to say what they're supposed to do.

Brian: I would imagine by going through that, practicing it or going through a simulation, talking it through that way, that's a good way to check to see if you've got huge gaps or holes in your plan. Once you've set this up, say we're dealing with a group now that has set up this disaster plan and they have it in place, how often should they go back and revisit it or renew it or do this training we're talking about? How often is protocol for that?

Rana: At a minimum annually. Because one, you're going to get new staff in. You're going to have staff leave. Things are going to change too. Technology changes. Where you are going to initially meet might not be there anymore. Now you need to meet somewhere else, so you absolutely need to be training your staff on this annually at a minimum and as you get new employees, make sure that they understand what the disaster plan is as well. Know where to go to find it. So, new employees, part of their onboarding is if a disaster happens, this is where you go to get the disaster plan this is where you need to go look. And then annually have all the staff either practice the disaster plan or at least train them on what the disaster plan is.

Brian: I was thinking as you were saying that part of your new employee orientation probably needs to encompass some form of training as far as your disaster.

Rana: You need to be training your new staff on OSHA. You need to be training new staff on HIPAA. It's just as easy to go ahead and also train your new staff on the disaster plan.

Brian: As we begin to wrap up, if there is a group that they are convinced now they need to start doing this, they need to jump in and be prepared, they can reach out to you and your department. Correct? You have more information that they-

Rana: They can absolutely call us, email us medical practice services. We're here to help with that kind of thing. We might not be able to sit down with them and actually do their disaster plan with them, but we can give them some resources where to go where you might find a sample disaster plan. Because unfortunately, a lot of groups want a sample handed to them that they can just kind of build off of. But a disaster plan, in my opinion, is something that is so personalized to that practice. It's really hard to have a one size fits all sample. So that's one reason why we just kind of give a basis and then for them to grow from there.

Brian: That makes sense to me. It's not a just insert name here type thing because as you said, a group that is, say, 60 doctors versus a group that is 3 doctors in an urban setting versus rural setting, those are going to look very, very different.

Rana: They definitely are.

Brian: What we can do as well is in our show notes for our podcast, be able to put some things there that would help them out. Rana, I really appreciate your time. Thanks for being here.

Rana: Thank you. I appreciate it.

Speaker 1: Thank you for listening to this episode of Your Practice Made Perfect, with your host Brian Fortenberry. Listen to more episodes, subscribe to the podcast, and find show notes at SVMIC.com/podcast.

The contents of this podcast are intended for informational purposes only and do not constitute legal advice. Policyholders are urged to consult with their personal attorney for legal advice as specific legal requirements may vary from state to state and change over time.