HIPAA - Emergency Access Procedure 164.312(a)(2)(ii)

Overview:
Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.

Action Items:
1) Obtain and review procedures related to emergency access. Evaluate the content in relation to the specified criteria to determine if an emergency access procedure is in place for obtaining necessary EPHI during an emergency. Elements to review may include but are not limited to: Procedures in place to provide necessary access to ePHI during an emergency; How access to initiate emergency access to ePHI is limited to appropriate personnel; How access to ePHI is normalized once an emergency situation has passed; Workforce members roles and responsibilities in the emergency access procedures
2) Obtain and review documentation demonstrating a list of workforce members with authority to initiate the emergency access procedures. Evaluate and determine if list of workforce members correlates with workforce members listed in the emergency access procedures.
3) Obtain and review documentation demonstrating technical systems limiting emergency access initiation. Evaluate and determine whether technical systems have the capability to limit emergency access initiation to authorized workforce members only.

Related Documents:
1) Procedures related to emergency access.
2) Documentation demonstrating a list of workforce members with authority to initiate the emergency access procedures.
3) Documentation demonstrating technical systems limiting emergency access initiation.

Additional Guidance:
These procedures are documented instructions and operational practices for obtaining access to necessary EPHI during an emergency situation. Access controls are necessary under emergency conditions, although they may be very different from those used in normal operational circumstances. Covered entities must determine the types of situations that would require emergency access to an information system or application that contains EPHI.

Procedures must be established beforehand to instruct workforce members on possible ways to gain access to needed EPHI in, for example, a situation in which normal environmental systems, such as electrical power, have been severely damaged or rendered inoperative due to a natural or manmade disaster.

Sample questions for covered entities to consider:
- Who needs access to the EPHI in the event of an emergency?
- Are there policies and procedures in place to provide appropriate access to EPHI in emergency situations?