Do you have a contingency plan? Have you documented or prepared anything for your practice? Yes, it is required by HIPAA, but do you really need HIPAA to tell you that you need one? In my opinion, it is basic best practices.

What is a Contingency Plan?

The wikipedia definition is: A contingency plan is a plan devised for an outcome other than in the usual (expected) plan. It is often used for risk management when an exceptional risk that, though unlikely, would have catastrophic consequences. Contingency plans are often devised by governments or businesses.

I used this definition because it is simple and to the point. If I had to choose one word, it would be “planning”. A contingency plan is good planning. If you do not have a contingency plan, you will have major setbacks if something happens. Aside from an earthquake, flood, hurricane, etc., below is a list of other things that could cause you to put your contingency plan in action.

  1. Major supplier goes bankrupt.
  2. Your most important employee up and quits.
  3. Power goes out for an extended amount of time
  4. Your entire staff gets food poisoning
  5. Your largest customer goes out of business

These things can all cause problems and chaos in your practice. It is in your best interest to prepare for them, and document all the necessary steps to keep your practice running.. Contingency planning is different from disaster recovery. You will need that as well, although they go hand in hand. Preparation is the key to keeping your practice running when thing happen.

What can you do?

The first thing you can do, is assemble a team, and perform a Risk assessment. The need for drawing up contingency plans emerges from a thorough analysis of the risks that your practice can face. What happens if you need blood drawn and the employees at Quest or Labcorp are on strike? It’s important to sometimes think outside the box. What happens when ‘Plan A’ doesn’t go as expected? Sometimes Plan A simply means ‘business as usual.’ Other times, with more sophisticated risk management plans, Plan A is your first response to deal with an identified risk – and when Plan A doesn’t work, you use your contingency plan. I guess you can call it Plan B!

Consider these in your risk assessment process:

  • Address all business-critical operations – A good plan identifies all critical functions for your practice.,
  • Identify risks – Identify what risks can occur, an what has the potential to significantly disrupt or harm your practice and your patients? Form a committee and start documenting these possibilities.Don’t be afraid or discouraged if after you compile your list, you find that you have a ton of work to do, and you are insufficient in many areas. Its okay. No one wants to have your head on a platter! It is best to prepare, and understand that you don’t have a plan in place, and you are working towards one. Believe me…if something happens and you are not prepared, your head will not only be on the platter, it will be served!
  • Prioritizing risks – One of the greatest challenges of contingency planning is making sure you don’t plan too much. You need a careful balance between over-preparing for something that may never happen, and adequate preparation, so that you can respond quickly and effectively to a crisis situation when it occurs. Risk Impact/Probability Charts help you find this balance. With these, you analyze the impact of each risk, and you estimate a likelihood of it occurring. You can then see which risks require the expense and effort of risk mitigation. Business processes that are essential to long-term survival – like maintaining cash flow, staff support, and market share – are typically at the top of the list.Note that contingency planning isn’t the only action that emerges as a result of risk analysis – you can manage risk by using existing assets more effectively, or by investing in new resources or services that help you manage it (such as insurance). Also, if a risk is particularly unlikely to materialize, you may decide to do nothing about it, and manage around it if the situation arises.

I can’t stress enough that you should get your plan in place BEFORE something happens. Its a good exercise for you and your staff. They physicians will appreciate it. You can never be too proactive.


Tier3MD is an IT support group for medical practices.


We only provide Medical IT support