In today’s rapidly changing environment, hospitals face an increasing number of risks, from natural disasters like Hurricane Beryl in Texas to Change Healthcare’s ransomware attack earlier this year. While healthcare institutions have always prioritized patient care, the importance of business preparation before a disaster strikes cannot be overstated.
Hospitals must be equipped not only to meet the immediate medical needs that arise during such events but also to ensure that their operations can continue with minimal disruption. With the number of ransomware attack claims rising 74% in 2023 as compared with 2022, a lack of preparation clearly could lead to dire consequences.
Why business preparation is essential
Hospitals are unique in that they serve as critical infrastructure within their communities. In the event of a disaster, they must maintain operations to deliver care to those in need, often under challenging and extreme conditions. However, this is only possible if the hospital’s business operations are resilient enough to withstand the initial impact of the disaster and continue functioning during recovery.
Business preparation is essential because it helps safeguard staff and patients, ensures compliance with regulations and prevents financial and reputational losses. Without adequate preparation, hospitals may face compromised patient outcomes, supply shortages and logistical challenges that could hinder their ability to provide critical care in the event of a disaster.
One of the primary reasons business preparation is critical is the vulnerability that disasters can expose. Hospitals, unlike other businesses, cannot simply shut down and wait for the crisis to pass. They must continue operating, often incurring additional costs for emergency staffing, supplies and equipment. Without proper financial and operational planning, including adequate insurance coverage and a clear understanding of available federal assistance programs, a hospital may struggle to recover fully from the financial strain of a disaster and face long-term disruption of its care mission.
Of course, not all disasters involve physical disruption. Cyberattacks are also a fact of life for hospitals, as for other organizations of all kinds. While the central topic of this article is not cyber breaches, the need for disaster preparedness still applies. During the pandemic, many local facilities dealt with ransomware attacks that left their electronic medical record systems inaccessible. Without provisions to maintain cybersecurity, patient data can be compromised and critical systems inoperable.
Key areas often missed in recovery planning
Despite the importance of business preparation, there are several areas that hospitals often overlook when evaluating their recovery needs and while reviewing their recovery plans. Some of these key areas include insurance policy review and claims management, collaboration with external parties, pre-positioned contracts and understanding Federal Emergency Management Agency (FEMA) Public Assistance and compliance requirements. These gaps can lead to significant challenges during and after a disaster, and addressing these often-overlooked areas is critical to developing a comprehensive recovery plan that ensures the hospital’s ability to respond swiftly and effectively to any crisis, safeguarding both patient care and operational integrity
Insurance policy review and claims management
One of the most commonly overlooked areas is a thorough review of insurance policies. Hospitals must ensure that their policies cover not only physical damage to buildings and equipment but also business interruption losses. Too often, hospitals fail to fully understand the intricacies of their insurance coverage, leading to disputes or delays in claims processing when a disaster occurs.
It is also crucial to establish a timeline for communications with insurers. This includes knowing when and how to file claims promptly, knowing what documentation will be required and having a plan for managing the claims process efficiently. Additionally, hospitals need to understand how their insurance intersects with FEMA Public Assistance, a federal program that can provide supplementary financial support. Failing to coordinate these resources effectively can result in incomplete or delayed recovery efforts.
Collaboration with external parties and pre-positioned contracts
Another critical area is the importance of collaborating with external parties before a disaster strikes. Hospitals need to establish relationships with vendors, contractors and other service providers who can assist in the recovery process. This includes setting up pre-positioned contracts that can be activated immediately following a disaster. Having these contracts in place ensures that the hospital can quickly access necessary resources, such as temporary facilities, emergency supplies and specialized labor, without the delay of negotiating terms during a crisis.
A well-developed business continuity plan should also include strategies for collaborating with local, state and federal agencies as well as other healthcare institutions. This collaboration can facilitate resource sharing, mutual aid agreements and coordinated response efforts, all of which are essential for maintaining operations during a disaster.
Understanding FEMA Public Assistance and compliance requirements
Finally, while many hospitals are aware of FEMA’s Public Assistance program, they often lack the preparation needed to navigate the complex process of obtaining federal reimbursement. FEMA Public Assistance can be a financial lifeline for hospitals, providing funding for emergency protective measures, debris removal, restoration services and the repair or replacement of damaged facilities. However, to be eligible, hospitals must meet stringent administrative and compliance requirements.
This process requires maintaining detailed records of all disaster-related expenses, ensuring that procurement processes adhere to federal guidelines, avoiding duplication of benefits and demonstrating that all recovery efforts are in compliance with FEMA regulations. Hospitals that are not prepared to handle these requirements may find themselves ineligible for assistance or facing significant delays in receiving reimbursement.
The time to prepare is now
Disasters are unpredictable, but the ability to respond effectively is not. Hospitals that invest the time and resources to prepare their business operations for the possibility of a disaster will be better equipped to protect their patients, staff and financial health. By diligently reviewing insurance policies, collaborating with external partners and understanding the intricacies of federal assistance programs like FEMA Public Assistance, hospitals can ensure that they are ready to face whatever challenges come their way. A well-prepared organization is not only more resilient in the face of crisis but also better positioned to recover swiftly and continue delivering critical services to the community.
In the healthcare industry, where the stakes are incredibly high, business preparation is not just a best practice—it’s a vital necessity. The time to prepare is now, before disaster strikes.
Jennifer Butler is a partner in EisnerAmper and leads the firm's Government Sector Services for advisory. With over 20 years in executive leadership roles, Butler has experience in grants management, managing federal programs and supporting entities to prepare for and recover from disasters.