Connie Christian, MBA, CPHRM

What do tornadoes, straight-line winds, flooding, roof damage, and burst or leaking water pipes all have in common? They can all wreak devastating damage to your practice or facility’s records. A plan to prevent a water disaster is essential, but knowing what to do to minimize damage after a water damage event takes place is just as important.

Water Damaged Electronic Drives and Devices

Data can be recovered from water-damaged drives and devices. Recovery of the data should be initiated as soon as it is safe to do so to increase the likelihood of success.[1]

When recovering data from water-damaged drives and devices, keep these key elements in mind:

• Do not attempt to recover the data yourself.
• Do not attempt to turn on the device or access the drive; this can cause further damage.
• Do not rinse drives or devices in water.
• Send the drive or device to a data recovery service or manufacturer and follow their instructions for packing and handling.
  • Remove batteries (if possible) from battery-powered devices prior to shipping.  The leftover charge in the battery can increase corrosion.
  • Pack drives and devices in boxes twice their size with packing material to minimize movement and contact with other items shipping in the same box.
  • If the drive or device is still wet, place it in a sealed container to maintain moisture and prevent further corrosion of the components.
  • Do not add water to the sealed packing container if the drive or device is dry.
  • Do not put drives or devices in drying agents such as rice or cat litter. These agents cause dust and debris to enter the drive or device and stick to the wet components, gumming up the interior just like corrosion.[2]
  • Handle the drive or device as little as possible.

Water Damaged Paper Records

Water-damaged paper should be handled as little as possible. It is important to act as quickly as feasible to prevent the growth of mold. Mold spores begin to grow within 48 to 72 hours in a non-ventilated area. Contact your general liability or property insurance agent for recommendations and resources.

Some initial actions you can take:

• In the record storage area, you should reduce the temperature and humidity while increasing air circulation. However, be aware that fans can circulate mold spores.
• If a professional document drying company cannot be contacted within 48 hours, place the records in a freezer.  This stops the continuation of mold formation and may preserve the ink within the paper.
  • Start with the wettest documents.
  • Do not open or clean the records.
  • Pack records tightly to avoid movement during transportation.
  • Do not thaw the records without obtaining professional advice. [3]

Reconstructing the Medical Record

If you can’t salvage the medical record or reconstruct it from an electronic data recovery, it should be recreated as completely as possible. It may be helpful to contact other entities that may have your patient’s information in their databases or medical record systems, including other treating physician practices or hospitals, health information exchanges, pharmacies, consultants, and third-party insurers.

The following strategies can assist in the reconstruction process:

• Inform patients in writing of their Protected Health Information (PHI) destruction.
  • Include the date and circumstances of the event.
  • Describe attempts to reconstruct their records.
  • Send the patient a history form to fill out.
  • Invite the patient to contact the Health Information Department to provide additional information.
  • Keep a copy of the reconstructed patient record in the patient’s new health record.
• Date the reconstruction with the current date.
• Identify the record as reconstructed PHI so there are no questions about whether the record is original.
  • Enter a description of the event and reconstruction efforts into the reconstructed patient records that include what happened specifically in that patient’s case, i.e., a letter was sent with a health history form, conversations with the patient or family in efforts to reconstruct the record, etc.
• If affected PHI is requested, the response to the PHI request should include documentation of damage and recovery efforts.
• Contact third-party insurers as soon as possible to determine if they require attestation forms.
• Notify all licensing agencies of the approximate number of lost or destroyed records and what actions you have taken in your restoration and reconstruction effort.[4]

Document the Damage

It’s imperative to document the damage and your plan to remediate the loss during recovery efforts.

Actions to take to document recovery efforts:

• Create a written description of the event, including the date, severity, duration, etc.
• Provide a detailed description of the damaged or destroyed records.
• Take photographs or videos of the damage and copies of property insurance claims documentation.
• Detail your plan and efforts to reconstruct the damaged or destroyed records.

HIPAA Privacy and CMS Waivers

According to the HHS Office for Civil Rights, “the HIPAA Privacy Rule is not suspended during a public health or other emergency; however, the Secretary of HHS may waive certain provisions of the Privacy Rule.”[5] CMS programmatic waivers may also be in effect. There are, of course, restrictions on these waivers, so contact your personal attorney to learn if these waivers are in place and how they affect your practice. If there is damage to paper or electronic medical records, execute business associate agreements with any vendor hired to help recover PHI.[6]

---

References

[1] DriveSavers Data Recovery. “Data Safety Advice for Hurricane Harvey Victims.” https://drivesaversdatarecovery.com/drivesavers-advice-for-hurricane-harvey-victims/ accessed 7/15/2022

[2] DriveSavers Data Recovery Blog. “Wet smart-phone rice trick: to rice or not to rice “ https://drivesaversdatarecovery.com/wet-smartphone-to-rice-or-not-to-rice/ accessed 7/15/2022

[3] National Archives. “Emergency Salvage of Flood Damaged Family Papers.” https://www.archives.gov/preservation/conservation/flood-damage.html accessed 7/15/2022

[4] AHIMA “Disaster and Recovery Toolkit” https://library.ahima.org/PdfView?oid=302895 accessed 7/18/2022

[5] HIPAA Privacy during disasters www.hhs.gov/hipaa/for-professionals/faq/1068/is-hipaa-suspended-during-a-national-or-public-health-emergency/index.html accessed 7/18/2022

[6] CMS 1135 Waivers at a glance www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertEmergPrep/Downloads/1135-Waivers-At-A-Glance.pdf accessed 7/18/2022