A written plan is also crucial. When disaster struck, Holly says SETMA invoked an automatic order that called for Dell to ship a new server to NextGen to reinstall the EMR software, and for a bank to run a line of credit “before any insurance involvement so we [could] get moving again.”

Here Holly means “practice interruption insurance.” He says, “I would encourage any practice to have that. Our practice lost about $1 million in revenue, as ongoing expenses were not arrested. The bank said we didn’t have to pay for 90 days, but eventually you have to. Practice insurance kept us going. There was a time I was worried, but it worked out.”

Finally, make sure that your backed-up data are encrypted before transit. Encrypted data are “scrambled” in a way that prevents outsiders from being able to read it. This is critical to protect the privacy of your patients’ information.

Shoulda-coulda-woulda

Unfortunately, no matter how thoughtfully and carefully you devise your backup and recovery plan, you’ll always discover something you wish you had done before disaster hit. Even Holly, whose practice has a comprehensive strategy, wishes he’d had a generator to run the network locally. “I’d like to have that so we could be up and live during the whole thing,” he says.

Holly feels good about his disaster recovery plan, but he’s definitely not bragging. “I don’t want to sound arrogant,” he says. “We’re certainly not immune. But we’re very careful. We’re dealing with life-and-death issues.”

And anything can happen. An air conditioning unit once failed in SETMA’s server room, catching everybody by surprise. “When the temperature got to a certain level, the system shut down. We realized then that the redundancy we were so keen on should include the A/C. So we’re putting one in, plus an alarm,” Holly says. “A system must be analyzed at every level for those single points of failure.”

Morrow says that his practice faced a reality check, too, after suffering through the Klez virus attack. “I thought we were good then. But you can’t know what you don’t know,” he says. “If there is a potential fault in our system, it would be in being sure that the data is being sent regularly. There are people being paid to make sure it is. But just because we’re signed up with Healthmatics Secure, it is not enough. You have to be sure. You have to check it, and we do.”

In short, don’t get complacent about your backup system, even after it’s in place and running well. Check it regularly, just as you would the oil in your car. If not, Morrow recommends “bigger bottles of Valium, I guess.”

Shirley Grace, senior writer for Physicians Practice, holds an MA in nonfiction writing from The Johns Hopkins University. Her articles have appeared in numerous publications, including The Washington Post and Notre Dame Business magazine. She can be reached at sgrace@physicianspractice.com.

This article originally appeared in the June 2007 issue of Physicians Practice.