Preparing for Emergencies Can Help FPs Avoid Business Losses

Solo family physician John Goff, M.D., worked in the same building on Cunningham Avenue in Joplin, Mo., for 30 years before it was completely destroyed, along with all of the practice's patient health records, by the powerful tornado (rated a "5" on the enhanced Fujita scale) that hit Joplin on May 22.

"It's all rubble," Goff recently told AAFP News Now. "It's just devastated. There's nothing left."

For Goff and other family physicians affected by this or a similar disaster, the AAFP offers this reminder: If patients' medical records have been lost or destroyed, certain actions must be taken under the Health Insurance Portability and Accountability Act, or HIPAA.

Fortunately, according to Gail Jones, manager of practice management in the AAFP Division of Practice Support, the AAFP has information on federal breach of information notification requirements, as well as what FPs should do in the event of a breach.

According to HHS' Breach Notification Rule, HIPAA-covered entities must notify patients -- in written form or via e-mail -- after they discover a breach of protected health information.

The notification should include a description of the breach, the types of information that were involved in the breach and the steps affected patients should take to protect themselves from potential harm. In addition, physicians should provide a description of what the practice is doing to investigate the breach, mitigate any harm and prevent further breaches.

Under certain conditions, the practice may meet the breach notification criteria by posting a notice on the home page of its website or by providing notice in local print and/or broadcast media.