May 2013

When Disaster Strikes
By Susan Chapman
For The Record
Vol. 25 No. 8 P. 22

A tempestuous Mother Nature? No worries. An unexpected power outage? Got it covered. A well-crafted business continuity plan can help ease hospital fears about data recovery.

Hurricane Sandy, which wreaked havoc in New Jersey and New York this past October, was a perfect example of why hospitals need to be prepared for what Mother Nature can bring, but there also are instances, albeit less far reaching, when data need to be recovered because of a system malfunction. Regardless of their source, disasters happen and hospitals need to ensure uninterrupted service and business continuity to continue to meet patients’ needs.

Moving From Disaster Recovery to Business Continuity
“I think it’s important to be clear on semantics when we talk about disasters and disaster recovery,” says Rob Drewniak, vice president of strategic and advisory services at Hayes Management Consulting. “For instance, a disaster recovery plan primarily deals with recovery of information technology and services following a disruption. Then there is a business resumption plan, which typically describes how operations will resume after such an event. Both types of plans imply a reactive response to an outage in critical operations or services.”

Recently, more health care organizations have taken steps to create a business continuity plan (BCP), he says. “This is especially important in the health care environment where, as in the case of Hurricane Sandy, outage time turned out to be significant, and it would not have been enough to just resume services,” Drewniak explains. “Those services have to be provided continuously, so the focus has shifted to sustaining delivery of those services.”

He adds that organizations can minimize the risks associated with outages, downtime, and data loss by developing and implementing a solid, comprehensive BCP designed to maintain patient care and operational stability.

To safeguard business continuity, how each component of the plan is governed and structured must be clearly understood and agreed upon within the organization from the leadership down. Likewise, goals and objectives must be defined. BCPs must be patient centered, with solid lines of communication, a well-prepared staff, and a well-conceived strategy to mitigate disruption.

Be Thorough
To create a comprehensive BCP, Drewniak says hospitals must conduct a business-impact analysis to identify and distinguish between critical and noncritical operational functions and processes. For example, in health care, functions related to patient safety would be considered critical.

“To create this type of plan, you have to do a number of things,” he explains. “For instance, the organization must do a threat analysis and look at all potential threats to the facility’s ongoing operation: fire, earthquake, cyberattack, and weather events. Then the planning team has to make recommendations as to how the hospital will recover from each threat. From that information, the team has to do a dependency analysis: What are the internal and external dependencies of critical services? How do they fit together?”

Brian McCrory, a solutions architect at SunGard Availability Services, seconds the notion that hospitals must be certain they understand the interdependence of applications, processes, and departmental recovery. For example, take a patient visit to the emergency department (ED), where clinical applications are tied to common departmental processes. “When a patient goes into the ED, the attendant takes that individual’s information,” he says. “That process is based on previously offered information if that individual has been seen there in the past, which is likely in the case of a neighborhood hospital. The entire process depends on another process in the system, and those interdependencies must continue to work seamlessly.”

McCrory says it’s essential when planning to take into account every component that could be affected in a disaster to make sure operations are in place and can continue. To that end, he recommends the BCP include a site-event management strategy that’s tailored to a facility’s specific needs. “The site-event management plan documents how you deal with the BCP at a very specific location,” he says. “If it’s a cardiac or brain facility, for example, the plan will be different than if it’s a trauma unit.”

It’s a challenge for health facilities to find reasonably priced resources that will keep operations up and running should a crisis occur. “What a hospital can afford is something every executive has his or her eye on,” Drewniak says.

Besides taking into account the facility’s resources when formulating a plan, the BCP team also needs to ensure that staff members are well prepared and determine who needs to be on site. “Not everyone needs to be at the hospital,” Drewniak says. “Those who do need to be there have to understand the plan and know their respective roles.”

McCrory notes it’s important to be sensitive to facilities’ limited resources and conduct interviews with department heads to ascertain their needs and resources. “We want to know what will happen to your hospital in the event of a disaster,” he says. “Business continuity is about mitigating risk. To build a plan, we examine the functions, determine what can be restored, how much time the process will take, and how much enacting the plan will cost.”

Business Continuity and IT
Health care organizations that fail to back up IT systems are playing with fire, says David Whitlinger, executive director of the New York eHealth Collaborative. “It’s very important that IT be backed up. In the event of a disaster, whether it’s something as catastrophic as Sandy or a simple power outage, technology can’t be down long,” he says. “Lengthy service interruptions can be mitigated or avoided altogether by using backup centers that are located across the country. When planning for IT recovery, planners must take into account the system’s size and scope, and focus on restoring those computer systems that safeguard patients and health records.”

According to Whitlinger, numerous hospitals have their own data centers, which offer some level of redundancy. “There are tape backups and, for more mature facilities, ‘hot’ backups, an exact replica of the data on a second set of hard disks that is located physically in a different secure data center but fully accessible via the network,” he says. “However, Hurricane Sandy ripped the whole northeastern seaboard, which posed problems for those facilities that had technological redundancies geographically nearby.”

Whitlinger says the best BCPs allow users to transition seamlessly to the backup system and continue working without ever realizing there was a problem. “But how hospitals address continuity of service depends on how much their levels of service matter to them, how much redundancy depends on this level of service, and also on how affluent the organization is,” he says.

In general, health care facilities want to ensure that service is never interrupted. To this end, they can use automated backup. “Most hospitals rent locations to back up and provide a secondary data service center,” Whitlinger says. “Smaller organizations spend more money on backup generators rather than on off-site locations to ensure redundancy.”

Considering that a protracted loss of power affected a wide area during Hurricane Sandy, New York-based hospitals were fortunate. One reason the situation didn’t worsen was the presence of a statewide health information network. “In New York, there is a statewide network which contains patient records. This provides New York with an advantage of having patient records backed up in the state network,” Whitlinger says. “What hospitals didn’t anticipate in the wake of Hurricane Sandy is that they would be without power for weeks. Thank goodness we had the state network to rely on.”

Because most facilities in other parts of the country may not have such a network at their disposal, Drewniak says hospitals must ask if they “have backup for our backup? And then, do we have backup for that?”

When structuring the IT component of a BCP, McCrory says facilities should examine several aspects. “Hospitals should analyze the crisis management component, a plan that fits the day-to-day operations of the organization,” he says. “They also need a comprehensive technology recovery plan that matches organization needs and resources. Finally, the IT team needs to know how it can recover critical applications and how those applications dovetail with others in the facility.”

Whitlinger points out that because technology changes rapidly, hospitals must test their plans to be sure they are current. “Hospitals must keep information for seven years. When they back up to tapes, they have to remember to have the technology available to read those tapes. So as technology moves forward, facilities need to be mindful of access. Even though we have information, we must be able to access it,” he says.

Testing the Plan
Because technology and other aspects of health care environments evolve, testing a BCP is crucial. “Events such as tornadoes and earthquakes, we don’t know when they’ll happen, so we need to know if the procedures in all areas of the hospital have been tested,” Drewniak says. “Were there tabletop [discussion-only] tests of complete drills? Major department heads should go through tabletop tests quarterly. If you wait or don’t test enough, then you don’t know if the plan is still current or valid when disaster strikes.”

While tabletop read-throughs are effective, Drewniak believes there also needs to be live drills. “These drills have to involve some movement,” he notes. “For example, can people get from the top floor to the bottom if the elevators are out?”

Illustrating the value of such drills, McCrory cites an image from Hurricane Sandy in which a nurse is carrying an infant down the stairs to safety in the midst of the storm. “Was that quick thinking on the staff’s part or the result of a well-tested formal process to preserve life?” he asks.

The frequency of testing is based on several factors, including regulatory requirements, the strategic thinking of hospital decision makers, and the facility’s best-practice policies. Experts agree that if plans aren’t tested, there is a greater likelihood of major problems occurring should an emergency arise.

Drewniak points out that when hospitals have time to prepare—as was the case with Hurricane Sandy—they must take advantage of the situation to perform time-sensitive functions such as transporting patients. Well in advance of any crisis, hospitals have the ability to identify vacant spaces, other hospitals, or alternate facilities that can house patients in the event of an emergency. “There are vacant buildings available,” Drewniak says. “For instance, there are cities where military bases are closed. You can also identify certain other hospitals that have capacity and can take patients. Not everyone is critical so those patients who aren’t in danger can be moved to facilities such as schools.”

Success in a Crisis
Because disaster, whether predictable or unexpected, can never be ruled out, experts encourage all hospitals to have a proven, comprehensive BCP in place.

“In the event of a disaster, businesses can rise and fall on what they do,” McCrory says. “Having a plan that’s well tested, current, and ensures uninterrupted service is critical to patients’ health and well-being, and a hospital’s ongoing success.”

— Susan Chapman is a Los Angeles-based writer and author.