Protecting Medical Records in a Disaster

X-rays rained down from the sky. Patient records sank to the bottom of swimming pools. Confidential forms with a person’s name, weight, and social security number ended up on strangers’ coffee tables alongside their junk mail.

Following the devastation of the Joplin tornado in May 2011, paper medical records were found more than 75 miles away in neighboring counties. This has caused many healthcare providers to re-examine their facility’s record-keeping procedures. The key is enacting a medical record security plan before it is needed.

“Whether they use paper records or an electronic health record, (clinicians) need to have an emergency procedure in place for their medical records,” said Tony Ryzinski, senior vice president of marketing at Sage Healthcare Division..

Electronic health records (EHRs) have been in use for more than a decade now. Although there is widespread debate about security and privacy of EHR, the tornado in Joplin made one thing clear: Paper medical records scattered about in people’s yards is simply not acceptable.

Threats to Patient Information
“We saw roughly the same thing following Hurricane Katrina. The issues that have come up after Joplin are the same issues that arise in any natural disaster: those who had systems that could be backed up and recorded off site did not lose their patient’s medical information,” said Ryzinski.

Just three weeks prior to the devastating tornado, St. John’s Regional Medical Center had joined its parent company (Sisters of Mercy Health System) electronic medical record system. Fortunately, the servers that contained St. John’s medical records were not damaged by the tornado.

The U.S. Department of Health and Human Services requires medical providers to “protect against any reasonably anticipated threats or hazards to the security or integrity” of records. Since tornados are frequent in Missouri, the burden of medical record protection falls on the medical facility. Hospitals can face serious financial and legal consequences if their medical records are compromised. Even more, on a personal level, patient’s experience a loss of trust and privacy when medical records are strewn about town or lost.

However, natural disasters such as tornados and hurricanes are not the only potential threat to patient’s medical records; fire and water damage can just as easily destroy years of information.

“For instance, we dealt with an MRI facility in Stockton, CA, that had a devastating building fire. Fortunately, they had an electronic system and all of their records survived. That is not always the case; when a facility burns down, much if not all of their paper medical records are completely lost as well,” added Ryzinski.

An EHR offers multiple means of protection that is simply not feasible with paper records. EHR can be backed up in three different ways: a backup tape in a secure location, hosting solutions on a server, or remote storage at two separate locations. All of these different methods of EHR backup ensure that, even if one location is destroyed in a disaster, the other copy will survive.

More Than Just Security
Joplin and other instances of natural disaster demonstrate the safekeeping an EHR can offer healthcare providers. Still, other fringe benefits exist as well. “An electronic health record enhances the relationship between patient and the healthcare provider. Patients derive a certain comfort in knowing that their ailments have been taken down verbatim and are accurately stored,” said Ryzinski.

Physical space is afforded by an EHR as well, whereas computer memory being much more compressible than filing cabinets. This provides an unexpected source of revenue for a facility since space is opened up for additional patients. “Beyond the security and space savings, electronic health records are more convenient for taking down information and it is much easier and quicker to call up detailed information,” said Ryzinski.

Records Travel With Patients
The fierce winds of the Joplin tornado sent medication and medical records into neighboring counties. The tornado also sent many injured people into the surrounding towns and states seeking medical care from facilities that survived the storm.

For the patients who had their medical records stored electronically, their medical history traveled faster than they did. Since they had a joint EHR, St. John’s Hospital in Springfield, MO, was able to receive patients and access their medical records from St. John’s Regional Medical in Joplin. Information pertinent to medication, dosage and which tests have been done followed patients in real-time.

St. John’s Regional Medical Center was extremely fortunate the tornado hit when it did. Had the tornado arrived three weeks earlier, thousands of patient’s medical records could have been forever lost.

A. Trevor Sutton is a frequent contributor to ADVANCE.