Five Keys to Disaster-Proofing Your Medical Practice with Spruce and HIPAA

“I have a situation. I have some open wounds.”

It was mid-September, and Hurricane Irma had just made landfall in Florida a few days before, forcing millions of people from their homes and causing severe destruction. The Spruce teledermatology group had kept up operations throughout the disaster, and now one of our patients from the affected area was contacting us on our app.

“I just got home after the hurricane, and I’m dirty and sweaty. I’m afraid the wounds will get infected if I don’t shower, but there is a boil-water warning for my city, and the government said not to let the water touch any wounds or they could get infected that way, too.

“I feel so stuck. I don’t know what to do. I left a message for my doctor here, but I’m not sure when he’ll be able to get back to me. This is one of those things that can’t wait until tomorrow. This hurricane, my god, it has created so many problems for me. I did not expect one more.”

Healthcare, Disasters, and HIPAA

It can be extremely challenging to provide good healthcare during a natural disaster, but that is often when it becomes most critical. The same forces that make care delivery difficult in an emergency, such as fire and flooding, also act to cause injury and other illness, increasing a community’s need for medical attention while simultaneously hamstringing its ability to supply it.

“This hurricane, my god, it has created so many problems for me. I did not expect one more.”

This inconvenient but important reality has motivated many emergency preparedness efforts, including some which reach as far as federal law and the HIPAA regulations that nearly all modern medical practices must follow.

Under HIPAA, medical organizations must ensure the availability of their patients’ electronic health information at all times, and this requirement applies equally during disasters.1 HIPAA also mandates that practices establish and maintain a “contingency plan” that allows them to respond to emergencies, including provisions for emergency-mode operations as well as for recovery to normal operations based on data backups.2

HIPAA requires medical practices to have formal disaster preparedness plans.

The Spruce platform, by design, keeps automatic redundant backups of all health information in multiple secure physical locations, so emergency-mode operation is seamless. We also power our telephony features in the cloud, so Spruce-based phone systems aren’t tied to one physical spot. This means that doctors on our platform can maintain contact with their patients from anywhere and at any time, just so long as they have either local phone or internet connectivity.

And that’s exactly what happened during Hurricane Irma.

Spruce and the Hurricane

Within 24 minutes of our patient’s initial message, our care team had been alerted to the patient’s message and had responded to him. Within 100 minutes, the patient’s treating physician, Dr. Andrew Styperek, had assessed the situation and replied with a full care plan. Importantly, this interaction was able to occur between a patient and a doctor who were both physically in Florida, at a time when dozens of hospitals and other medical facilities in the state were closed indefinitely. This was only possible because of Spruce’s distributed, cloud-based infrastructure, which has a strong inherent resistance to physical disaster.

“We may have no gasoline, no power, no internet, and very little cell phone signal, but my doctor is there and did not leave me.”

“Thank you, doctor! This is a lifesaver for me right now! I cannot be more grateful to you, and I can honestly say my experience with you and my care coordinator on here has been the best I think I have had for years.

“We may have no gasoline, no power, no internet, and very little cell phone signal, but my doctor is there and did not leave me, not even for a second. It is amazing how we went through a hurricane and lost almost everything, but you guys did not miss a beat and have been there for me through thick and thin and at all hours. This is priceless!!”

And to complete the happy ending, the patient’s wounds healed quickly and without infection.

When we first started our telemedicine group on Spruce, I dreamed of medical results like these, outcomes that illustrated the power of our platform and our team to provide care that was not only as good as, but sometimes even better than, what could be done in person. If I hadn’t seen our patient’s messages myself during our quality review committee, I might not believe they were real.

Spruce Results for Everybody: 5 Keys to HIPAA and Disaster-Proofing Your Practice

While I’m very proud of our operations during Hurricane Irma, there wasn’t actually any magic involved in our success. The results we got were the simple endpoints of having constructed a disaster-resistant practice, and that is something that both good sense and HIPAA mandate that every healthcare organization should try to do.

Whether or not you use Spruce to help you with this, here are five critical keys to disaster-proofing your medical practice.

1) Keep your health data in the cloud

The “cloud” is just a modern term for distributed, internet-accessible computing, but that doesn’t diminish its usefulness. Assuming that you want to store any of your organization’s health data electronically, then using the cloud can save you critical legwork on many disaster-preparedness and HIPAA requirements that might otherwise be impossible for a medical practice, including:

  • Installing and maintaining server computers
  • Creating redundant data and server backups in multiple physical locations
  • Ensuring both the electronic and physical security of all systems storing data
  • Regularly auditing all systems and processes to make sure that they continue to meet HIPAA requirements for technical, administrative, and physical safeguards

Cloud-based medical platforms like Spruce take care of all of these critical items for you, giving you the benefit of being able to securely access your practice’s data wherever and whenever you want to, including during disasters, without the huge infrastructure investment that this used to require.

Since cellular networks now also offer reliable internet access, you’ll be able to access your cloud-based data even if your regular internet service provider is down. This was the case for our teledermatology group during the hurricane, as our patient had no regular internet access, but he could still reach his care team through a cell phone app.

If you want to safeguard against a full internet and cellular outage, you can also keep a local copy of your practice’s data, but you’ll have to safeguard it carefully. This may be an important step, depending on your needs, but it has still clearly become a secondary concern compared to the overwhelming advantages that keeping your data in the cloud can provide to your organization’s disaster preparedness.

2) Make your phone system accessible from anywhere

If your patients have medical needs during a disaster, they will try to call your office, but it won’t do any good if there’s a phone ringing in a flooded clinic that nobody can hear or answer. The solution, however, is easy: make your phone system adaptable and virtual.

New technology (like Spruce!) now allows you to have a fully functional medical-grade phone system that can manage multiple numbers, secure voicemail, phone trees, number forwarding, and other essential features, all while being configurable on the fly. When things are running normally, you can direct your numbers to clinic desk phones or cell phones, as you choose, and then you can switch it all up during a disaster so that every incoming call goes to a phone that can be answered.

We all grew up with the idea that a phone number is tied to a specific device, but that doesn’t have to be true anymore. Cloud-based phone services let you keep your numbers constant while changing what’s ringing on the backend. In a disaster, this capability is invaluable for preserving your organization’s accessibility, even if you can’t keep your physical doors open.

3) Have telemedicine capabilities

Even if you don’t want to make telemedicine a typical part of your practice, you should keep it in your toolbox for emergencies. If you or your patients can’t get to your clinic during an emergency, telemedicine may be able to save the day. But you have to be ready to use it ahead of time.

There are many telemedicine platforms you can choose, so pick your favorite. My favorite is obviously Spruce, but there are also many reasons for that. We designed Spruce telemedicine with mobile devices in mind, including cell phones, and these are the most likely technology items to be active in a disaster. When our patient contacted us after the hurricane, it was from his cell phone. There will undoubtedly be more where that came from.

4) Support as many communication channels as possible

It can be difficult to predict exactly what will be disrupted by a disaster, so having a communications system that supports channels beyond standard phone calls and video-based telemedicine may allow patients to reach you who would otherwise be out of luck.

Modalities like texting, secure messaging, email, and asynchronous clinical question sets can extend your disaster-mode capabilities significantly and provide your patients and your staff with crucial flexibility when dealing with unusual circumstances. If emergency cellular networks and low phone batteries won’t allow for full-fledged video or even voice calls, simple messaging can still answer important patient questions and provide critical guidance.

Spruce supports such advanced communication options, and again, these channels were the most useful communication pathways for our patient during the hurricane’s aftermath. Pictures and secure messaging stood in effectively where an in-person visit would have been both impossible and unnecessary.

5) Figure out exactly how much of your operation can run remotely

I’m an emergency medicine physician, so I’m no stranger to care that can only be delivered in person and hands-on. Running a telemedicine group on Spruce, however, has given me many opportunities over the past four years to appreciate just how much good medicine can actually be accomplished with no physical building.

Being forced to adopt this mindset has had the happy side effect of putting our group at an advantage during disasters, since we’re used to not having an office space or fixed equipment to rely on. Having seen the benefits of this in action, I strongly believe that it’s worth every organization’s time to figure out how much of its workflow can be virtualized and, thereby, disaster-proofed.

If you move your phone system to the cloud (Spruce phones!), could you have a front-desk person work entirely remotely, if need be? He or she could route calls to a home phone instead of a desk phone and then handle scheduling, refills, paperwork requests, and other typical activities, all while remote.

If you set up secure team messaging, could your group handle patient call-backs, answer simple medical questions, approve new prescriptions, and complete other standard care tasks from afar, without anybody being in the same physical place?

What percentage of your typical visit types could you handle over secure patient messaging or video chat, if need be? I’d encourage you to think hard about this one, because unless you’re doing unavoidable procedures all day long, the true number might be higher than you’d expect.

If you take time to minimize your practice’s reliance on specific physical things, you’ll automatically improve your ability to function during a disaster.

“This has been a lifesaver for me.”

At its core, the practice of medicine depends on patients and their healthcare teams being able to communicate, and disasters get in the way of that. It is critical to prepare your organization for such disruptions, but it doesn’t have to be onerous to do so, and the needed changes may even improve your regular operations.

In the end, despite the tragic losses inherent to any disaster, being adequately prepared will allow you to provide care that makes you proud of what you’ve done and the effort that you’ve invested. And your patients will certainly be better off for it.

“Thank you guys so much! I’ve showed all my friends how amazing my experience with you has been. Hopefully it rubs off on some of them because this truly is some of the best medical care I have received in years, so I want it to thrive. This has been a lifesaver for me.”


  1. 45 CFR § 164.308(a)(1)(ii)(A)
  2. 45 CFR § 164.308(a)(7)
  3. Title photo: Stranded Ambulance by Alec Perkins, taken during Hurricane Sandy (2012)

Related Articles

Meet Lex Lancaster, PT, DPT, a physical therapist turned digital entrepreneur now helping other heal...
Join Spruce Health and Thomas (T.J.) Ferrante, a Partner in Foley & Lardner’s Telemedicine Ind...