NY HIE Shares Storm Lessons

Insights on Data Storage Strategies
NY HIE Shares Storm Lessons

As East Coast healthcare organizations slammed by Superstorm Sandy recover, some disaster planning lessons are emerging. That includes lessons for participants in health information exchanges, especially those using a federated data architecture model.

See Also: Research Finds Only 45% Compliance with NIST CSF Controls

In the federated data architecture HIE model, patient records from participating hospitals and clinics remain under the control of each organization instead of being stored in a central repository. Often, participants use edge servers that hold copies of patient data that the provider is willing to share with other HIE members. Then these servers can be queried via the HIE for records, for example, when a patient is transferred - as was common during the storm.

The benefit of the federated HIE model is that the individual organizations retain clear control over their own data, potentially enhancing security. But if the location of an edge server gets flooded, as was the case at some hospitals in New York City during the height of the storm, then the ability to share patient data with other HIE members is lost (see: HIEs: Help in Disasters?.)

Healthix an HIE serving New York City and Long Island, maintained operations during and after the storm, but not all of its participating members were as lucky, says Tom Moore, Healthix vice president.

For example, NYU Langone Medical Center lost power during the hurricane due to serious flooding, which knocked out power to its onsite edge server. The hospital evacuated hundreds of patients.

As a result, records on that server for evacuated patients transferred to other Healthix participating hospitals weren't readily available for at least a day, Moore says.

Healthix's IT infrastructure is managed by New York eHealth Collaborative, which is the designated statewide HIE in New York. As part of that relationship, New York eHealth Collaborative offers Healthix members free remote hosting for their edge servers, Moore says.

Still, very few Healthix participants have chosen to have their edge servers remotely hosted, Moore says. But that could change in the aftermath of Superstorm Sandy.

"Moving ahead, I think virtual edge servers will become a bigger part of the discussion for disaster planning for HIEs," he says.

Flood Damage

Officials at NYU Langone Medical Center haven't yet commented on whether a remote HIE edge server will become a part of its disaster planning in the wake of the storm.

But in a statement to HealthcareInfoSecurity, an NYU Langone spokesman says the medical center's emergency power system was designed and built according to all safety codes.

"We believed we could withstand a surge of approximately 12 feet, which is above the 100-year flood level for New York City. During Hurricane Irene in 2011, this facility did not suffer any major damages," he says.

"Even though our facility and our faculty and staff were trained and prepared for the storm, this was an unprecedented event," he adds. "The surge from Hurricane Sandy was recorded at 13.88 feet at Battery Park, which was 2.68 feet higher than the record level in 1821. In our location, we believe the surge from Sandy may have been even higher."

About the Author

Marianne Kolbasuk McGee

Marianne Kolbasuk McGee

Executive Editor, HealthcareInfoSecurity, ISMG

McGee is executive editor of Information Security Media Group's HealthcareInfoSecurity.com media site. She has about 30 years of IT journalism experience, with a focus on healthcare information technology issues for more than 15 years. Before joining ISMG in 2012, she was a reporter at InformationWeek magazine and news site and played a lead role in the launch of InformationWeek's healthcare IT media site.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.