May 22 of 2011 was a normal Sunday afternoon. My (Dr. Croy's) 14-year-old son and two of his friends were hanging out in the basement, while my older son, Sam, was playing in the band at the Joplin High School graduation. My husband came in from outside to let me know there was a storm coming. We worried a bit about when Sam would be home, mostly because he was a new driver and his old truck isn't great on slick roads. Sam arrived home safely about five minutes before it started hailing. We had no idea what destruction he had barely missed. It wasn't long before the radio started reporting terrible damage in the largest retail area of town. Then a nurse friend texted us that she had been called into work because the hospital, which is on the opposite side of town from the retail area, had been hit by a tornado. We were starting to get an idea something bad had happened, but we did not yet know that our town had been hit by the deadliest single tornado of the last 60 years.

When you own a business, you plan for a lot of things – fire, broken water pipes, theft, and disease outbreaks – but I don't think it ever crossed my mind I would lose my office building to a tornado. We often have tornado warnings from April through July in this area of the country. We hear the sirens and worry if the sky turns green, but it usually causes no more than low-level anxiety. We never expected a storm bad enough to take out one-third of our town. Fortunately, the planning I had done earlier helped my practice recover quickly. I hope some of the things I experienced will help you with planning how to protect your practice from a disaster.

The real hero: Our EHR

Our electronic health record (EHR) was a key factor in being able to get back to business within three days after the tornado. We were lucky in that we were able to recover our servers from the ruin of our office building, but it provided peace of mind knowing that backup copies of the EHR and other protected health information (PHI) were held securely off-site had we needed them. Some practices hit by the tornado were still using paper medical records, the remains of which were scattered across the state. (The only paper charts in our office were more than six years old and scheduled to be destroyed soon anyway.) Other practices did not have off-site backups, so their data was lost with their servers.

To protect patient information, the HIPAA (Health Insurance Portability and Accountability Act) security rule requires practices to have a contingency plan in case of a natural disaster, fire, vandalism, or system failure. The plan must include policies and procedures for responding to an emergency that damages health information technology (IT) systems, and it must assist the practice in adhering to important aspects of the HIPAA security rule that may not immediately come to mind (e.g., the proper method for disposal of a damaged server that contains PHI). There are many useful resources to ensure that you are compliant with the security rule, such as the HIPAA Security Rule Toolkit. Two elements of the contingency plan were particularly useful in our recovery. The Data Backup Plan establishes procedures for the regular update and storage of PHI; it is important to discuss this with your IT vendor and to make sure you know exactly what this procedure is. The Disaster Recovery Plan deals with procedures for the restoration of data. In our case, our IT company was onsite immediately and got our computers running in two days, even after having to clear mud out of one of the servers.

One of the main anxieties as a physician trying to provide care for patients after the disaster was staying on top of test results, since the usual channels of communication were down. Fortunately, our EHR has an order-tracking feature that proved invaluable. It lists all the tests we have ordered but have not yet received, so we knew exactly what we needed to track down from outside labs or testing centers.

Take-away lessons

Although the importance of having an EHR with an excellent backup system was the number one take-home lesson we learned, there were plenty of other key lessons as well.

1. Take your own pulse. You cannot concentrate on recovering your business unless you know your family is safe. I had contacted my parents early on, and my kids were with me, so even when the cell phones went down, I could concentrate on the business.

2. Be prepared to practice out of a temporary site. Although it may be impossible to identify an alternative practice site before a disaster strikes, practices should at least think through their options and what that would entail. We spent the day after the storm salvaging what we could from our damaged building – starting with needles, syringes, and injectable medicines, then the remaining paper charts and patient records, and finally the usable equipment and supplies. The next day, our local Crisis Pregnancy Center offered us temporary housing in their satellite office – fully equipped, including computers, a working fax machine, and Internet access. I went to an electronics store in town (our phone provider's store was destroyed) and bought a cell phone so we could forward our office's telephones to our new site. Our IT people set up our servers for remote access. On the third morning after the storm, we started seeing patients – a true miracle of modern technology. We were in that clinic for six weeks until we could find a more permanent temporary home in a strip mall. We had to do a little remodeling of that space, but insurance paid for that as well as new equipment, since our building was a total loss. We should be rebuilt and moved into a new permanent home by Labor Day 2012.

3. Don't neglect your business records. Patient records are usually everyone's top priority when creating a contingency plan, but your financial records are also important. Like our patient records, our financial records are electronic and backed up off-site. Without this information, the practice would have had difficulty functioning.

4. Review your insurance coverage. Excellent insurance is a necessity and worth every penny you pay for it. Fortunately, we have a great insurance agent who calls every few years to update our coverage limits to keep up with new equipment and extra expenses. Many business owners in town did not have business interruption insurance, and of those who did, quite a few did not review and increase their limits as their businesses grew.

5. Surround yourself with an excellent team. Our staff put in long hours rescuing and cleaning all kinds of things from the damaged office, and then cleaning and setting up two temporary offices. Much of this work was done after hours and on weekends so we could be available for patient care during business hours. Staff members even used their personal cell phones to make patient calls for six weeks after the storm. They never complained. We would not have been able to get back in business just three days after losing our office if it weren't for this wonderful team.

6. Pay attention to the details. If you want your insurance company to reimburse you for the extra expenses the disaster caused, you will have to document and justify every penny. You will need to keep track of expenses and phone calls to utilities and vendors. Keep all pertinent receipts. It's a pain. We ended up tracking all this with an Excel spreadsheet and just wish we had started a little sooner.

7. Expect a drop in collections. In natural disasters where a large portion of the population is affected, be prepared to take a hit from bad debt from patients not paying their bills. Since the tornado, we've had to turn over more than $7,000 worth of debt to collections.

8. Be flexible and patient. Most of the displaced doctors' offices in our community are still in trailers situated on land near the campus of the destroyed hospital. A modular hospital has just opened, but it will take three years to build the permanent hospital structure. Perhaps two-thirds of the destroyed businesses are finally open. The rebuilding of our high school hasn't begun yet, but they are hoping that will be finished by 2014.

Although the recovery process can be slow and frustrating, keep in mind that things will gradually get back to normal. You may not have the same equipment you were used to, certain aspects of your EHR may not work properly for a while, there will be things you forget to replace until you need them, and you will be surprised at what you miss. (One thing we missed most was being able to communicate with patients via email, which is interesting considering how much resistance there can be to the adoption of this technology.) Eventually, however, you will recover and move forward. One year later, our practice is still waiting to move back into our own building, but not only have we survived – we are stronger.