A Detailed Management Plan In Cases of Natural Disasters - Essay Example

Running Head: Security and Privacy A Detailed Management Plan In Cases of Natural Disasters Introduction People respond differently to emergencies and disasters depending on various factors which influence their behavior. Organizations cannot solely rely on diverse reaction patterns of individuals in times of fire, medical emergencies, bomb threats or even natural disasters. To ensure each individual’s safety, organizations prepare a detailed management plan which encompasses emergency response procedures to state explicitly how the facility will respond to emergencies and disasters as required (Employment Law Information Network 2009). This essay is written for the purpose of presenting a management plan in detail to outline the appropriate response procedures during natural disasters. It would identify the actions that need to be taken, the proper authorities to be reached and relevant suggestions and recommendations to address these situations, the training required for the staff and the courses of action to implement the plan. Case Scenario #2 (Natural Disaster) Living on the Gulf Coast is a benefit that many residents of this small Southern town enjoy. However, natural disasters that occur affect some residents. The town has just been struck by a hurricane and the entire basement is flooded by the storm surge. Patient files were destroyed or washed away with the receding water. What actions should be taken when patients come looking for their health records? What processes are applied in the organization to protect the records in anticipation of such an event? Response Procedures The first thing that security and management personnel should do to protect the patients’ records when natural disaster, like hurricane, strikes is to be ready with emergency operating records. Health care organizations “cannot afford outages. Data loss, similarly is not an option”. (Talon, 2005, par. 2) Vital records must always have backup files stored in offsite areas. Storing relevant patients’ records outside the healthcare institution would ensure that in times of natural disasters, patients’ database remain intact in a safe place. All health care practitioners should be trained and oriented on the terms and conditions imposed by the Health Insurance Portability and Accountability Act (HIPAA). (Talon, 2005, par. 3) This act “requires that data must not only be protected from theft and accidental disclosure, but it must be protected from data loss as well.” Actual data recovery objectives must be identified to determine the Recovery Point Objective (RPO) and the Recovery Time Objective (RTO). Talon (2005, par. 5) averred that “RPO is the amount of data that can be lost to a disaster, usually rated in seconds or minutes of lost data. RTO is how long the system can be offline, usually rated in minutes to hours to days in some cases. Life-sustaining equipment and the file servers that contain the data they need to operate will have the tightest numbers when it comes to RTO and RPO.” This information is vital when natural disasters strike because critical database determine the areas that need close monitoring and protection. As part of the disaster recovery approach, patients should be informed that the backup files would keep their records safe and secure. When patients come looking for their records, health care practitioners must assure that their files would be available at the soonest possible time and clearly detail the time and date their records could be accessed, after recovery. Another advice recommended by Talon (2003, par. 11) is routing, to wit: “once failover occurs, route your clients to the appropriate servers. Either offer multiple connections for end users to choose from, or allow for multiple VPN tunnels for offices to utilize. Both of these solutions require that your staff is ready to jump in and assist, since most of your end users wont be able to handle this part of the failover operation.” The health care staff should be reminded to keep confidentiality and patient’s privacy in divulging information or files. Records should only be given to the patients or their authorized representative, consistent with the HIPAA, as required. Training for Staff and Code of Conduct An endeavor serves a specific purpose. Training personnel for emergency response during disasters aim to contribute to the achievement of the organization’s goals by ensuring safety and security of the resources of the organization including the patients. Generally, the training would make the personnel aware and inculcate the code of conduct for health care practitioners, to wit: (1) ensure appropriate knowledge of HIPPA laws especially in conforming to confidentiality and privacy; (3) protect confidential information by strictly advising all personnel not to divulge information or details about the patients; (4) maintain a safe and secure workplace; (5) manage health information files through regular update and backup; (6) enforce all lawful rules and regulations; (7) encourage liaison with information technology department and the security department in ensuring backup files are available and accessible at offsite areas by authorized personnel; (8) strive to attain professional competence in dealing with the patients at all times; (9) protect patients records like protecting and ensuring safety for the patients themselves; and (10) attain high standards of health and medical ethics. (IFPO, 2008, p. 4) An effective training should use various forms of instructional methods and materials to assist and guide the health care practitioners in learning and absorbing the theories, concepts and applications of the training course focusing on emergency response and protecting patients’ records during natural disasters. The correct combination of educational methods should be used since this training would prepare the staff in the actual work environment. Therefore, the training should provide methods that are closely related to actual events to develop skills and tactics for future eventualities. Presentation of areas to be covered, specifically on HIPAA, as well as the specific time frame should be provided for time management and to assess the developments in class discussion. Each unit or topic would initially be discussed through lecture and discussion method. However, the trainor could opt to use the participants to either engage in group activities or group reports to enforce learning and to make the discussions more interesting and lively. The most important part is to determine if the personnel understand or absorb the theories imparted through constant and regular quizzes, examinations and simulated emergency exercises. Emergency plans are eminently critical in ensuring that businesses create contingency plans for employees’ safety and protecting patients’ records. The training course would assist personnel in identifying if the organization have created and updated his emergency and contingency plans in disaster scenarios. According to Kirvan (2009), a business continuity planning process contains the following steps, to wit: “project initiation, risk assessment, business impact assessment, strategy development, plan development, plan exercising and maintenance, emergency communications, awareness and training and coordination with public authorities.” (par. 1) In itself, this topic encompasses different aspects of security management and patients’ confidentiality which would be developed in the health practitioners’ competence through the training course. Protecting Patients’ Records In times of disaster, like hurricanes, a health institution must ensure that emergency operating records for business continuity during and after the emergency situations are properly maintained. These includes the following: “emergency plans and  directive(s), orders of succession, delegations of authority, staffing assignments, selected program records needed to continue the most critical agency operations, as well as related policy or procedural records that assist agency staff in conducting operations under emergency conditions and for resuming normal operations after an emergency.” (NIH Vital Records Program, 2005, par. 7) The relevant points to consider under protecting patients records are as follows: (1) patients records and other vital information should be duplicated and stored at an off site storage location; (2) backup tapes must be regularly updated and maintained; (3) vital records should be reviewed annually or regularly as needed to ensure their completeness; (4) obsolete records must be removed to give way to updated vital records as necessary; and (5) all authorized personnel and officers responsible for maintaining and disposing patients’ records must be duly identified and made accountable for their specific responsibilities. As noted under the NIH Vital Records (2005, par. 9), “off-site storage is a facility other than the organization’s normal place of business where vital records are stored for protection. This is done to ensure that the vital records are not subject to damage or destruction from an emergency or disaster affecting the organization’s normal place of business.” Implementation of the Plan Implementation of the plan starts with identification of the authorized officers responsible for maintaining, monitoring and updating emergency response procedures in the organization. As Information Systems Manager, the responsibility of ensuring patient confidentiality, protection of privacy and security rests under ones jurisdiction. Next, the emergency plans and directives must be explicitly and clearly presented. The health information system must be in place. Management must make sure that all health care practitioners are appropriately trained in areas of patients’ confidentiality and privacy as well as in maintaining a health information system. An appropriate health care information system must be installed, managed, monitored, and updated to conform to the requirements of HIPAA. Conclusion Every organization should formulate emergency plans in cases of accidents and natural disasters. Management should devise clear and concise structure of events compliant to the emergency preparedness response and responsibilities. A health care organization is under close supervision and monitoring of the Department of Health and Human Services especially in the areas of ensuring privacy of patients and explicitly stating security standards for the protection of electronic protected health information. Awareness and appropriate immediate action is always the key in emergency response planning and implementation to ensure patient privacy and security. References Employment Law Information Network. (2009). Emergency Response Procedures. Retrieved 09 September, 2009 from International Foundation for Protection Officers (IFPO). (2008). About the Protection Officer Training Manual. Retrieved 09 September, 2009 from Kirvan, P. (2009). Using a business continuity plan template: A free business continuity template and guide. Tech Target. Retrieved 09 September, 2009 from National Institutes of Health (NIH). (2005). NIH POLICY MANUAL: 1744 - NIH Vital Records Program. Retrieved 09 September, 2009 from Talon, M. (2005). Disaster recovery challenges for the healthcare industry: File servers. Retrieved 10 September, 2009 from Talon, M. (2003). Tech Tip: Protect your file servers from disaster. Retrieved 10 September, 2009 from Read More