July 9, 2007

Protecting Vital Records
By Van Carlisle
For The Record
Vol. 19 No. 14 P. 12

Vital records protection (VRP)—whether for paper-based or electronic medical records (EMRs)—remains a crucial management issue for medical professionals. Many practices prefer to outsource the entire backup and protection process to an outside service provider.

Unfortunately, when on-site VRP is ignored or inadequately addressed, it can lead to serious consequences if a fire, hurricane, flood, or other natural disaster occurs and causes damage to the practice. Every practice will have vital records on site at some point, and no one can predict the precise time a catastrophe will occur.

Some current information, such as active patient records, daily transaction logs, managed care contracts, and even nonmedical (yet still categorized as vital) records pertaining to operational issues need to remain on site and adequately maintained and protected. Such documents may include contracts and agreements that prove ownership of property, equipment, vehicles, products, etc; operational records such as current or unaudited accounting and tax records; personnel and payroll records; standard operating procedures (SOPs); and reports, audits, and summaries.

Information on data backup and protection—a necessity in the modern practice—is available through a plethora of literature, guidelines, and standards. Most practices employ various combinations of on-site VRP, including fire-rated vaults, safes, or file cabinets; off-site storage; and storage with vendors that specialize in off-site storage.

On-site Security
HIPAA dictates that medical records must be stored in a secure, fire-protected location in a fire-resistant file or vault that has been tested by Underwriters Laboratories (UL), a not-for-profit product safety certification organization. This ensures backups are 100% safe from the minute they are created until being archived.

Media Other Than Paper
In the age of the EMR and the modern digitized practice (although solo practitioners are least likely to use EMRs), a key issue for on-site VRP is protecting vital records stored on microfilm, microfiche, optical disks, magnetic tapes, disks, cassettes, CD-ROMs, DVDs, and photographic materials.

These “other-than-paper” documents need special protective measures throughout their life cycle to ensure preservation. Among these measures are deploying specially designed data cabinets and vaults that supply specific environmental conditions, including temperature and humidity controls. Standard fireproof file cabinets designed for paper and microfilm don't provide enough protection for magnetic tapes, disks, and diskettes because the ignition points of paper and microfilm are much higher than those of magnetic media. Paper is destroyed at 400°F, while a magnetic tape becomes useless at 125°F. Since many modern practices store their vital data on CDs or removable Zip drives, they should consider specially designed containers called media vaults, which are used to store and protect patient records from the harmful effects of heat, humidity, dust, and magnetic fields.

For the storage of on-site vital records, even if only for a limited time, it is imperative to use products tested by UL or other nationally known independent testing labs.

Selecting an Off-site Vendor
When choosing an off-site storage vendor, make sure to understand all the charges involved, including in and out fees, privacy, and security. Also know what type of care is used to transport the data and the type of storage facility. Consider distance, accessibility, safety, and service.

The storage facility should be far enough away from your facility to ensure that a major disaster won't affect both locations. Rural and low-traffic areas can be more secure and easier to guard. Avoid facilities in high-risk areas, including those near airports, railroads, and chemical plants or those in flood plains and tornado belts. Also make sure the vendor is accessible 24 hours per day within a reasonable period of time so you can obtain the records quickly.

Recovery of Vital Records
Although it seems easy to become distracted with the VRP process, it is important to note that the main drivers for medical practices are business continuity, disaster recovery, and—especially for medical practices—recovery strategy. To make sure vital records can be removed in a disaster, keep master lists or an index of what's stored where. List specific categories of vital records, develop a document-tracking plan, designate a secure relocation destination, and arrange for primary and backup transportation. Make sure you have the off-site vendor's 24-hour contact information, necessary clearances, and permits, as well as contact information for the internal personnel assigned to accompany the records. Finally, train the responsible party to handle and preserve records based on the specific media involved.

Conclusion
All types of medical offices must carefully establish records of protection policies and procedures and document why they chose certain tactics and technologies to secure their vital records. Simply stated, the need for all practices to better manage vital records has increased dramatically over the past few years. Get behind this issue now to figure out the best set of VRP solutions for your practice.

— Van Carlisle is president and CEO of New Albany, Ind.-based Fire King, a security and loss prevention company.

Resource
Underwriters Laboratories (UL) is an independent, not-for-profit product safety certification organization that has been testing products and writing safety standards for more than one century. UL (www.ul.com) evaluates more than 19,000 types of products, components, materials, and systems annually, with 21 billion UL marks appearing on 71,000 manufacturers' products each year.