Health Center Emergency Response Resources

October 2024

Ready to take the next step towards enhanced IT preparedness? The resources linked below, organized by topic, share actionable strategies that health centers can implement to move towards greater resilience.

Preserving access to Electronic Health Record (EHR) data

The Office of the National Coordinator for Health Information Technology’s Safety Assurance Factors for EHR Resilience (SAFER) self-assessment for contingency planning identifies recommended practices for managing EHR downtime, including use of redundant hardware, regular backup of data, use of uninterruptible power supplies, and protocols for use of paper forms.

The American Medical Association’s Guidelines for Developing EHR Downtime Procedures includes a list of considerations that planners can use when developing or improving information technology EHR downtime procedures. 

Preventing cyber-attacks

The HITEQ Center’s Guide to Essential Cybersecurity Tasks For Health Centers with Limited Resources provides a baseline of day-to-day tasks that health center IT and compliance staff should consider to protect their systems and comply with regulatory requirements. These include strategies to prevent successful phishing attacks, limit unnecessary physical and virtual access to systems, and keep security patches up to date. 

Responding to cyber-attacks

The U.S. Department of Commerce National Institute of Standards and Technology’s Guide for Cybersecurity Event Recovery describes the contents of a typical cyber-attack recovery plan and includes a checklist of items (a “playbook”) that should be implemented as part of the recovery process. 

Leveraging EHR data for patient outreach

The HITEQ Center’s “Accessing Your Data: Questions to consider with your Electronic Health Record Vendor,” is a checklist that can be used to talk with vendors about how health centers use EHR system capabilities for activities such as report generation. Relevant questions include 1) whether data, including reports, can be accessed from any location at any time; 2) whether and how your practice can generate ad hoc reports; and 3) whether it is possible to query the EHR to identify certain patients, for example, those with particular conditions, using particular medications, or in a particular geography.

Some EHR enhancers, such as Relevant’s Data Explorer, enable health centers to use the EHR to build reports without writing code and automate text messaging to subsets of patients.

Sharing data to prevent or lessen a serious or imminent threat

The U.S. Department of Health and Human Services Office for Civil Rights’ Hurricane Katrina Bulletin: HIPAA Privacy and Disclosures in Emergency Situations and Summary of the HIPAA Privacy Rule address the use and disclosure of protected health information by covered entities when that disclosure is believed to be necessary to prevent or lessen a serious and imminent threat to a person or the public.

Sharing data to support care continuity

In addition to the strategies for preserving access to EHR data, participation in local or state health information exchanges (HIE) or in vendor-supported EHR based data-sharing initiatives (e.g., Epic's Care Everywhere or eClinicalWorks PRISMA) facilitates data sharing.  Learn more about HIE capabilities in HITEQ Highlights: Advancing Interoperability & Health Information Exchange for Health Centers.