EHRs should factor into practice continuity plans

Most physicians have plans responding to computer system failures, but many don’t revisit those disaster recovery/business continuity plans with any regularity, health IT experts said.

That’s a mistake.

Certainly, the reliability of computer systems is much higher now than in past decades, but failures still happen – whether they stem from short-term power loss or lost Internet connections or from crippling malware attacks. And with more than 80% of physicians using computerized records, a downed electronic health record (EHR) system for whatever the reason could stop a practice cold in its tracks.

As a result, “it is really incumbent on small physician practices to understand what it takes to keep the business running in case of a disaster,” said Michael McCoy, MD, chief executive officer of consulting firm Physician Technology Services Inc.

Here are five points to survive an EHR outage:

Have and revisit your plans.

Devise a plan and revisit it on a regular schedule to ensure it adequately addresses the latest additions and updates to your EHR application as well as the ancillary computer systems that connect to it, McCoy said, adding that it’s worthwhile to work with a consultant who specializes in disaster recovery and business continuity planning.

Practice those plans.

Diligent doctors might think they’re in good shape simply because they have a disaster recovery plan and are following pre-emptive steps, such as backing up EHR files to tape. But medical offices that suffer a real outage often find they’re not able to cope due to lack of practical experience and/or problems in their plans, McCoy said. Drills will not only give staff that practical experience it will reveal any flaws in the plan, such as corrupted backup files.

Next: Work with your vendor

Coordinate with your EHR vendor.

Restoring patient records is only part of what’s needed following an EHR system failure. The other big piece is restoring the actual application with all the updates and patches that have come through since it was first installed, health IT experts said. “You have to have the ability to restore a valid, non-corrupt back up,” McCoy explained.

Don’t assume the cloud is foolproof.

Cloud providers generally offer higher levels of redundancy and cybersecurity than any individual practice can muster, but health IT experts said a cloud-based EHR is still vulnerable to outages. “They still have hardware issues; they have software issues,” McCoy said. Physicians with a cloud-based EHR still need to have disaster recovery and business continuity plans in place, and those plans could possibly include backup of patient records beyond what the cloud vendor provides.

Know how to transition back to the electronic system.

Disaster recovery plans should – but often don’t – include strategies for transitioning back to restored computer systems, said Thomas Payne, MD, FACP, medical director of IT services at University of Washington School of Medicine and board chairman for the American Medical Informatics Association. “Often times when systems are down, physicians use paper and then the question is, how much of that record should be entered back in,” he explained. It’s better to map out in advance what data should go back into the electronic records, who will handle that work and at what cost.