business of Medicine


Disaster Recovery Toolkit

July 25, 2019

Preparing for a disaster

Establish a written Emergency Action Plan (EAP)

Occupational Safety and Health Administration (OSHA) regulations require employers to have in place emergency action plans. 29 CFR § 1910.38(a). An Emergency Action Plan (EAP) organizes and outlines actions to be taken in the event of an emergency. Once a plan is developed, employees should be trained on how to quickly and safely respond in a disaster or emergency situation. This will reduce potential damage and possibly save lives.  

OSHA regulations set out the minimum required elements of an Emergency Action Plan. 29 CFR § 1910.38(c).

At a minimum, an EAP must include:

  • Procedures for reporting a fire or other emergency, procedures for emergency evacuation, including type of evacuation and exit route assignments
  • Procedures to be followed by employees who remain to operate critical facility operations before they evacuate
  • Procedures to account for all employees after evacuation
  • Procedures to be followed by employees performing rescue or medical duties, and
  • The name or job title of every employee who may be contacted by employees who need more information about the plan or an explanation of their duties under the plan

Link to standard:

Download a sample emergency action plan here. 

Perform a hazard vulnerability analysis

A hazard vulnerability analysis (HVA) is performed using a tool to evaluate and score a facility’s vulnerability to specific emergency events. This systematic approach evaluates the most common hazards based on probability, magnitude of impact, and mitigation/preparedness, and results in the calculation of a total risk score that provides facilities with a better understanding of relative threat levels for various emergency events. The HVA is typically an evolving document that is reviewed and calculated annually. Events with high risk scores should be prioritized when planning, mitigating, and developing response and recovery plans.

Currently, Kaiser Permanente is nationally recognized for its “gold standard” HVA Analysis Tool found here:

Download a hazard vulnerability analysis template here. 

Ensure appropriate insurance coverage

Facilities should know and understand what their insurance will cover in the case of a disaster. Questions a facility should ask when obtaining insurance coverage include: whether the policy will cover damage due to natural disasters such as floods or earthquakes; whether the policy will cover relocation costs if the facility must move to another site; whether the policy will cover lost or damaged supplies, structural repairs, or damaged or destroyed equipment; and whether the policy will cover business interruption and lost revenue.

Define emergency response roles

It is important to establish who is responsible for what functions during an emergency. All staff should understand their specific roles, participate in safety training programs, and understand evacuation procedures/routes. During a disaster, additional responsibilities may need to be assigned. Assigning these responsibilities before a disaster occurs allows the individual to plan, ask questions, and obtain and safeguard any necessary information, etc.

Other potential responsibilities in emergency preparedness and response include:

  • Reviewing and updating applicable policies
  • Performing and sharing hazard vulnerability analysis
  • Ensuring employee training
  • Activating the Emergency Action Plan
  • Determining facility closures, openings, and relocations
  • Communicating to all employees (e.g., by implementing a telephone tree)
  • Contacting local health department/news organizations
  • Contacting patients/business partners
  • Updating social media accounts
  • Assigning employee duties/responsibilities
  • Determining appropriate staffing levels
  • Monitoring situation for changes
  • Tracking damage and losses

Maintain contact lists and standardized communication methods

Compiling and regularly updating contact lists with preferred communication methods will allow a facility to communicate efficiently with its employees and business partners.Facilities should consider various communication methods such as phone calls, telephone trees, text messages, emails, website positing, social media, etc. Contact lists should be kept confidential both onsite and offsite. Key business partners include, but are not limited to: utility providers, insurance companies, vendors, maintenance/repair personnel, local emergency response facilities, public health departments, medical societies, local hospitals, and billing companies. Having contact information readily available will help reduce stress, confusion, and wasted time during emergency situations.

Find a sample employee contact list here. 

Find a sample business partner contact list here.

Itemize key elements for continuity of operations

Some emergency events can damage items in the facility and/or prevent employees from gaining entry to the facility. It is therefore imperative for facilities to have additional protections and remote access to important documents. Safeguarding these items will allow for the continuation of operations once the facility is open and accessible.

Key elements for continuity of operations include:

  • Medical equipment – Maintain a list of all equipment that includes serial numbers, purchase dates, costs, preventative maintenance schedules, and any contracts for service. Secure equipment, utilize surge protectors, and mount fire extinguishers near critical equipment.
  • Medical supplies – Maintain a list of all necessary supplies and corresponding vendors. Determine ability to securely store and/or stockpile critical supplies and determine ability to rapidly obtain additional supplies from alternative vendors, if needed.
  • Medical records – Protect paper records from potential damage by using fire/waterproof cabinets and storing them off of the floor. Protect electronic records by maintaining paper lists of patients and contact numbers, using secure servers, and requiring back-up systems.
  • Vital business records – Store copies of critical legal and financial documents (e.g., bank records and contracts or agreements) in a secure offsite location.

Create specific plans for high-risk events

After completing the hazard vulnerability analysis, select high-risk events and develop plans to mitigate risk, standardize a response, and determine training needs.

The government website has information about planning for numerous potential emergencies such as wildfires, flooding, tornadoes, and hurricanes. This information can help you understand these risks and develop an appropriate emergency response plan. It also provides tips and resources that can be discussed and shared throughout your facility.

Conduct Training with Employees

Employees should be educated about the facility’s safety plans upon hire and should be updated and retrained as needed.

At a minimum, employees should know:

  • The location and operation of fire extinguishers
  • To dial 911 and how to alert others in the case of an emergency
  • How to safely evacuate from the facility and the reunification spot
  • The location of any emergency medical equipment
  • Employee roles during an emergency
  • Communication plans for external emergencies that impact operations



Evacuation Plans and Procedures eTool


Kaiser Permanente's Hazard Vulnerability Analysis Tool

Responding to a disaster


The information provided in this resource does not constitute legal, medical or any other professional advice, nor does it establish a standard of care. This resource has been created as an aid to you in your practice. The ultimate decision on how to use the information provided rests solely with you, the PolicyOwner.