Is your office prepared for a disaster?
By Steven E. Fisher, MBA
The impact of Hurricane Katrina should come as a wake-up call for orthopaedic surgeons who have not implemented plans for dealing with events that may interrupt their business operations. This article presents a general framework for developing a comprehensive disaster prevention and recovery plan; a future article will focus on the logistics of implementing the plan. Additional information can be found on the AAOS online Practice Management Center
Although individual orthopaedic surgeons and their staffs can do nothing to prevent a major regional catastrophe such as Katrina, they can do a lot to prevent “office-specific” disasters as well as less serious adverse events. They can also develop plans to enable resumption of key operations after such an event. All it takes is foresight, planning and the judicious expenditure of a certain amount of money. It’s important to recognize that this money isn’t an investment per se; it is the price you pay to protect yourself against a catastrophic loss.
Establish a task force
The best way to develop a disaster avoidance and recovery plan is to create a task force with an assigned leader. The task force should consist of at least three people: a physician, an administrator and a clinical support person.
The task force should meet weekly while developing the plan. Once the plan is finalized, the task force should meet semi-annually to reassess and revise it.
The final plan should be in writing, distributed to all physicians and staff, and stored in at least two secure locations, including one off-site. Any paperwork that relates to the plan (such as asset receipts, photographs, insurance policies, vendor contracts, service agreements and contact numbers) should be attached to the plan copy stored off-site.
Larger practices, with several offices and complex telephone, computer and medical records systems, may want to consider using an outside consultant to develop their disaster prevention and recovery plan. Once the plan is developed, however, an internal task force should oversee and fine-tune it.
Identify the problems
The task force should identify those events that could prevent normal practice operations. Disasters and serious adverse events can be divided into two general categories:
• Physical damage from a fire, flood, smoke, vandalism, wind or rain due to a regional event or an office-specific one
• Operational or logistical problems such as a death, criminal activity, loss of power or phone service, or equipment breakdowns
• Determine the likelihood
Different problems have different likelihoods of occurring and levels of impact on operations. The task force should therefore next develop a grid with four compartments, as shown.
Each identified problem should be placed in one of the four quadrants. This enables you to focus first on events that are both likely and serious.
Before you start developing recovery plans for every likely and serious event, however, it’s important to do whatever you can to reduce (a) the likelihood of the event’s occurring in the first place, and (b) its impact on office operations if it does occur. For example:
Secure insurance coverage. It’s impossible to overestimate the importance of being adequately insured. The most common forms of insurance needed for disaster recovery include:
• Comprehensive business coverage to provide damage protection from fire and other mishaps
• Property insurance to cover damage to your building and contents from perils such as fire, water damage and vandalism
• Business income insurance to help replace lost income as a result of damage that temporarily shuts you down
• “Key man” life insurance to provide funds if a key person (usually one of the doctors in a small practice) dies
• Fidelity insurance to protect against loss caused by the dishonesty or nonperformance of an employee
Work with a qualified insurance agent who knows your state insurance laws, is familiar with your office location and understands the insurance needs of medical practices in general. The task force should interview at least three insurance agents before making a selection. Be sure you understand which companies the agent represents and why the agent has selected those companies.
Before you purchase any policy, take the time to read the fine print about exactly what is included and what is excluded. Ask “What-if-XYZ-happens?” so you know whether the policy will cover specific events. Meet with your broker at least once a year and notify him or her whenever you open or close an office or initiate a new service. Regularly “re-bid” your insurance business to get the best coverage at the lowest rates.
Keep your physical facility in tip-top condition. Even minor fires and floods can make an office unfit for habitation for months. Periodically have a licensed inspector review your wiring and plumbing and install fire, smoke, freeze and carbon monoxide alarms. Periodic inspections of your office infrastructure may help lower your insurance premiums.
Be sure your computer systems are up-to-date. Many practices function with computer systems that have antiquated hardware and software, and/or that the vendor no longer supports. If the computer system malfunctions, your office may not be able to schedule patients, send out bills or insurance forms and/or process payments.
It’s key, therefore, to keep your system up-to-date, and to back up all records—both clinical (if you have electronic medical records) and financial—and remove back-up files from the premises every day. One of the most compelling reasons for moving to online medical records is that the information won’t be irretrievably lost if your office is seriously damaged or destroyed by a catastrophe.
Protect yourself proactively against theft. Depending on where your practice is located, theft may or may not be a major concern. But it would be unwise to dismiss this possibility completely even in the most isolated areas. It’s not just money, furniture, fixtures and equipment that can be stolen; it’s also medical/surgical supplies, office supplies, drugs, and clinical and financial data. Finally, be sure your implementation plans address both outside and internal thieves.
Most thieves steal from places where physical and electronic controls have not been installed and internal control procedures have not been implemented. Installing such controls and implementing such procedures, and advertising the fact that you have done so, will radically reduce the likelihood of theft occurring in the first place.
Finally, develop and implement recovery plans for every adverse event you’ve identified, focusing on how each one would affect both front and back office functions. Front office functions relate to scheduling office appointments and surgeries and the actual provision of patient care by physicians and allied health personnel. Back office functions include patient and insurance billing, the posting of payments, medical record maintenance, bill payment and creation of monthly statements.
Depending on the nature of the event, it may be possible to resume back office operations even before front office operations resume. Many back office functions can be done in any place and at any time of day, but front office functions require a specific space for patients and their care. As you begin to develop recovery plans, ask questions such as:
• What is the event and which function will be affected?
• How does it relate to other functions?
• Who performs the function now and what skills do they need?
• How long would it take to hire or recruit another person for this function?
• Is there a specific place and time where and when the function needs to be performed?
• What information do staff need to do their jobs?
• Where are the data currently maintained?
• Are the data available elsewhere?
• What supplies, machinery and equipment are required?
• Can you use supplies, machinery and equipment located elsewhere?
Armed with the answers to these questions, the task force should generate “If...then” scenarios and document them. The totality constitutes your disaster recovery plan.
Steven E. Fisher, MBA, is manager of practice management affairs at AAOS. He can be reached at (847) 384-4331 or email@example.com.