Recovering Water-Damaged Records After a Disaster

Whether it’s a hurricane, an earthquake or secondary damage from a fire, many disasters involve extensive water damage to paper and electronic records. How you handle recovering water-damaged records is critical to ensuring the most complete recovery possible. Below are recommendations for what to do — and what not to do — as part of your disaster recovery.

Handling Water-Damaged Electronic Drives & Devices

Data can be recovered from water damaged drives and devices; however, the sooner you start on the data recovery, the greater the likelihood of success:^1,2

• Do not attempt to recover the data yourself.
• Do not attempt to turn the drive/device on, which can make things worse.
• Do not rinse drives or devices in clean water.
• Send the drive or device to a data recovery service and follow their instructions for packing and handling.
  • If the device is battery-powered, remove the batteries (if possible) before shipping. Leftover charge in the battery can increase corrosion.
  • Pack drives/devices well in boxes twice their size so they do not move or come in contact with other devices during shipping.
  • If the drive/device is wet, place it in a sealed container to maintain moisture. This keeps the components from further corroding.
  • If the drive/device has already been dried, do not put extra water in the sealed container.
  • Do not put your drive/device into a drying agent such as rice or cat litter (here’s why).
  • Handle the device as little as possible.

Handling Water-Damaged Paper Records

Handle wet records as little as possible and do your best to prevent them from molding. Mold starts to grow within 48 hours so it’s important to take action as soon as possible.³ Contact your general liability/property insurer for recommendations and resources and suggestions for a professional document drying or document recovery vendor. Here are some initial actions you can take:^3,4

• Reduce the temperature and humidity and increase the circulation in the record storage area.
• If a professional document drying company cannot be contacted within 48 hours, place the records in a freezer.
  • Start with the wettest documents.
  • Do not open or clean the records.
  • Pack records tightly to avoid movement during transport.
  • Do not thaw the records without obtaining professional advice.

HIPAA Privacy and Medicare and Medicaid Services (CMS) Waivers

According to the HHS Office for Civil Rights, “the HIPAA Privacy Rule is not suspended during a public health or other emergency; however, the Secretary of HHS may waive certain provisions of the Privacy Rule.”⁵ CMS programmatic waivers may also be in effect.⁶ There are, of course, restrictions on these waivers, so contact your personal attorney to learn if these waivers are in place and how they affect your practice. If there is damage to paper or electronic medical records, execute business associate agreements with any vendor hired to help recover PHI.

Reconstructing the Medical Record

If you cannot salvage the medical records or otherwise reconstruct them via electronic data recovery you should recreate them to the best of your ability. Approach the various other entities that are storing your patients’ PHI in their own databases and record-keeping systems. For example, pharmacies, consultants, prior treating physicians, third party insurers, transcription services and hospitals most likely have PHI they can provide. The following strategies can facilitate the reconstruction process:

• Inform patients in writing of their PHI destruction.
  • Include the date and circumstances.
  • Describe attempts to reconstruct their records.
  • Send the patient a history form.
  • Invite the patient to contact you to provide additional information.
  • Keep a copy of the patient record in the patient’s new file.
• Date the reconstructed record with the current date.
• Identify the record as reconstructed PHI so there is no question as to whether the record is reconstructed or original.
• Contact third party insurers as soon as possible to determine whether they require attestation forms.
• Notify your state board of medicine of the approximate number of records that were lost or destroyed and what actions you’ve taken in your restoration and reconstruction effort.

Document the Damage

Document the damage as best you can during your recovery efforts, including:

• Description of the event (date, severity, duration, etc.)
• Descriptions of the damaged or destroyed records
• Photographs or videos of the damage and copies of property insurance claims documentation
• Description of efforts to reconstruct the damaged or destroyed records

If the damage includes medical records:

• Enter a description of the event and reconstruction efforts into reconstructed patient records that includes what has happened specifically in that patient’s case, e.g., that a letter was sent with a health history form, that conversations took place with the patient/family in efforts to reconstruct the record, etc.
• If affected PHI is requested, include documentation of PHI damage and recovery efforts with your response to the PHI request.

References

1. National Archives and Records Administration Preservation Programs. Electronic Media – Hard Drives. (accessed 6/5/2019)

2. DriveSavers Data Recovery. “Data Safety Advice for Hurricane Harvey Victims.” (accessed 6/5/2019)

3. Leigh Ann Henry. “Recovering Flood-Damaged Records.” Family Practice Management. 1998 May;5(5):76-78. (accessed 6/5/2019)

4. National Archives. “Emergency Salvage of Flood Damaged Family Papers.” (accessed 6/5/2019)

5. U.S. Department of Health and Human Services (HHS), Office for Civil Rights. BULLETIN: HIPAA Privacy in Emergency Situations. (accessed 6/5/2019)

6. U.S. Centers for Medicare & Medicaid Services (CMS). Additional Emergency and Disaster-Related Policies and Procedures That May Be Implemented Only With a § 1135 Waiver. Version 11, 3/15/2019. (accessed 6/5/2019)

---

Reference herein to any specific product, process, service, or entity does not necessarily constitute or imply the endorsement, recommendation, or favoring by the NORCAL Group of companies.