Building Your Emergency Preparedness (RHC and FQHC): Risk Assessment
We know many of you are currently rushing to meet the November 16, 2017 deadline for developing your Emergency Preparedness Plan for your Rural Health Clinic (RHC) or Federally Qualified Health Center (FQHC). As you do so, the Centers for Medicare & Medicaid Services (CMS) wants you to keep in mind these three key essentials for maintaining access to healthcare during disasters and emergencies;
- Safeguarding human resources
- Maintaining business continuity
- Protecting physical resources
In addition, your emergency preparedness plan will be made up of these four sections;
- Emergency Plan (including risk assessment)
- Policies and Procedures
- Communication Plan
- Training and Testing Program
In developing your emergency plan, you must first conduct a facility based risk assessment. You may already have some or most of this accomplished because you conducted the HIPAA security rule’s risk analysis and implemented a risk management plan. Nevertheless, CMS wants your risk assessment to take an all-hazards approach. An all-hazards approach looks at all possible emergencies and disasters and spells out the response procedures for each. You can’t depend on procedures for responding to one type of emergency to provide sufficient response for a different type of emergency. For instance, your procedures for an active shooter in your facility will not help you respond to a ransomware attack of your electronic health records. Makes sense, right? Your risk assessment and subsequent plan should identify and include procedures for natural, man-made, and/or facility emergencies. It should;
- Identify all business functions essential to the facility’s operations that should be continued during an emergency
- Identify all risks or emergencies that the facility may reasonably expect to confront
- Identify all contingencies for which the facility should plan
- Consider the facility’s geographic location
- Assessment of the extent to which natural or man-made emergencies may cause the facility to cease or limit operations
- Determination of what arrangements may be necessary with other health care facilities, or other entities that might be needed to ensure that essential services could be provided during an emergency
CMS uses the term “facility-based” to mean the risk assessment and emergency preparedness program is specific to your facility. This is important as this approach will more clearly identify as well as eliminate, natural disasters for your facility and area. For instance, an RHC in Florida should consider preparedness actions in the face of an approaching hurricane as opposed to an RHC in South Dakota which should consider capabilities after a three-day winter blizzard, which is more reasonable to expect. On the other hand, both RHCs should assess and develop plans to respond to a power outage which was not caused by a natural disaster, yet does require immediate response to continue operations. For instance, do you have backup generators and fuel to run the generators, thereby providing the power needed to run essential operations?
CMS allows you as an RHC to use a community-based risk assessment developed by other entities, such as public health agencies, emergency management agencies, and regional health care coalitions or you can use theirs while conducting your own facility-based assessment. If you use a community- based risk assessment and plan, you need to have a copy of it and you need to work with the organization that developed it to ensure it meets the needs of your facility’s emergency plan.
Again, you may have already addressed these emergencies and hazards while implementing your HIPAA plan and policies, so a review of your plan may only require additional considerations. We at HIPAAtrek believe that many of the CMS requirements are already addressed by the HIPAA security rule. We are currently putting together an Emergency Preparedness Plan and HIPAA security rule cross-walk so you don’t have to reinvent the wheel; so be on the lookout for it. Until then, review your current HIPAA security plan for similarities that meet the CMS Emergency Preparedness Plan requirements and/or begin to document your all-hazards risk assessment.