Health Center Health IT Emergency Response Resources

Updated January 2025

Ready to take the next step towards enhanced IT preparedness? The resources linked below, organized by topic, share actionable strategies that health centers can implement to move towards greater resilience.

Preserving access to Electronic Health Record (EHR) data

• The Office of the National Coordinator for Health Information Technology’s Safety Assurance Factors for EHR Resilience (SAFER) self-assessment for contingency planning identifies recommended practices for managing EHR downtime, including use of redundant hardware, regular backup of data, use of uninterruptible power supplies, and protocols for use of paper forms.
• The American Medical Association’s Guidelines for Developing EHR Downtime Procedures includes a list of considerations that planners can use when developing or improving information technology EHR downtime procedures. 
• If you’re considering installing solar microgrids, Capital Link offers information in Building Resilient Health Center Facilities and shares case studies in Net Zero Health Centers.

Preventing cyber-attacks

• The HITEQ Center’s Guide to Essential Cybersecurity Tasks For Health Centers with Limited Resources provides a baseline of day-to-day tasks that health center IT and compliance staff should consider to protect their systems and comply with regulatory requirements. These include strategies to prevent successful phishing attacks, limit unnecessary physical and virtual access to systems, and keep security patches up to date. 
• The Office of the National Coordinator for Health Information Technology (ONC), in collaboration with the HHS Office for Civil Rights (OCR), developed a downloadable Security Risk Assessment Tool to help guide you through the process.

Responding to cyber-attacks

• Federal cybersecurity organizations such as the Cybersecurity & Infrastructure Security Agency (CISA) actively publish risk management frameworks and incident response plans, including one specific to ransomware, that can be leveraged by health centers when developing incident response plans.
• The U.S. Department of Commerce National Institute of Standards and Technology’s Guide for Cybersecurity Event Recovery describes the contents of a typical cyber-attack recovery plan and includes a checklist of items (a “playbook”) that should be implemented as part of the recovery process. 

Leveraging EHR data for patient outreach

• The HITEQ Center’s “Accessing Your Data: Questions to consider with your Electronic Health Record Vendor,” is a checklist that can be used to talk with vendors about how health centers use EHR system capabilities for activities such as report generation. Relevant questions include 1) whether data, including reports, can be accessed from any location at any time; 2) whether and how your practice can generate ad hoc reports; and 3) whether it is possible to query the EHR to identify certain patients, for example, those with particular conditions, using particular medications, or in a particular geography.
• Some EHR enhancers, such as Relevant’s Data Explorer, enable health centers to use the EHR to build reports without writing code and automate text messaging to subsets of patients.
• The National Association of Community Health Center’s Heat-Related Illness Management in EHR Systems contains methods for integrating heat-related illness alerts into EHRs. 
• Resources like Centers for Disease Control and Prevention’s Heat and Medications and Americares' Climate Resilience for Frontline Clinics Toolkit can inform what information to include in patient outreach.

Sharing data with emergency response entities to prevent or mitigate a serious or imminent threat

• The U.S. Department of Health and Human Services Office for Civil Rights’ Hurricane Katrina Bulletin: HIPAA Privacy and Disclosures in Emergency Situations and Summary of the HIPAA Privacy Rule address the use and disclosure of protected health information by covered entities when that disclosure is believed to be necessary to prevent or lessen a serious and imminent threat to a person or the public.

Sharing data with other healthcare providers to support care continuity

• In addition to the strategies for preserving access to EHR data, participation in local or state health information exchanges (HIE) or in vendor-supported EHR based data-sharing initiatives (e.g., Epic's Care Everywhere or eClinicalWorks PRISMA) facilitates data sharing.  Learn more about HIE capabilities in HITEQ Highlights: Advancing Interoperability & Health Information Exchange for Health Centers.
• Collaborating with local organizations and partners can further response and equity. Examples of this are outlined in the case study on page 36 of the American Medical Association’s Embedding equity in crisis preparedness and response in health systems.