Planning For the Unexpected In Healthcare
05 Sep 2006
by Mark Roman, EDS Global Healthcare LeaderCreating a Holistic Business Continuity Plan for Your Healthcare Organization
About the Author
Mark Roman
Mark Roman is the global leader of EDS' Healthcare Industry practice, which provides products including an advanced care management system, EDS Atlantes, and the highly acclaimed MetaVance administration and finance system. With a 26-year career in consulting and business process improvement, Roman has extensive industry knowledge and experience in the provider, payer, life sciences and government health segments.
Events such as Hurricane Katrina, September 11th and the North American blackout in the summer of 2003 demonstrate that it is crucial for any company to have a business continuity management plan in place. But continuity of operations in the healthcare industry goes far beyond maintaining or recovering basic business operations and IT systems – it's a matter of life or death.
Minuscule details such as staff contact information and patient relocation protocol could ultimately determine how resilient a healthcare facility is during an emergency. This human factor makes preparation, mitigation, response and recovery from business disruptions highly complex in the healthcare environment.
Taking a holistic approach to business continuity and disaster recovery plans can help ensure risk mitigation and protection of critical business processes and assets. When developing a business continuity plan for your healthcare organizations, keep these key factors in mind:
- Electronic Health Records (EHRs)
Although the adoption of electronic health records has been slow, the need for EHRs has never been more apparent than during the recent hurricanes. With thousands of paper medical records, as well as some medical facilities, destroyed by the hurricanes, victims of the disaster were left to rebuild their health history from scratch. And without access to medical history, providers had no information about past treatments, previous illnesses or medication allergies, which could easily put patients at risk.
EHRs go with the patient wherever they receive treatment, which in an emergency situation can mean the difference between life or death. And now with recent regulations, the adoption of EHRs could be expedited, helping to solidify this piece of your business continuity plan.
- Staff Recovery/Planning
Most business continuity plans are revenue driven. This is also true for healthcare providers, but revenue is secondary to human life. From doctors and nurses to security officers and chefs, employees are the most essential part of a healthcare provider's business continuity plan. The ability to recover staff and take care of their needs is critical to getting operations up and running. Likewise, it is imperative that human resources technology systems are functional to access employee contact information, payroll functions and job skills databases to reassign staff to parallel job functions as needed.
- Patient Safety
As in day-to-day operations, patient safety is a priority. Healthcare organizations need to establish protocols on how to deal with the sick in various scenarios (e.g., bioterrorism, contamination, mass casualties). This plan should include a clear definition of acceptable levels of treatment and prioritization of care. Providers should also consider how and who will transfer vital medical records – whether paper or electronic – as patients and operations are relocated during an emergency.
- Information Recovery
Before any emergency situation, healthcare providers must identify essential data and systems for successful operation. As electronic medical records become commonplace, it will be essential for hospitals and other healthcare facilities to consider off-site storage and back-up of data to make it is easily accessible during an emergency. They must also identify alternative facilities enabling them to replicate critical communications systems supporting connectivity to internal organizations, external organization such as local governments and the public.
- Facilities Recovery
A hospital can be likened to a big hotel with guests who are unable to leave on their own volition. Hospitals and care facilities need to have an alternative location(s) for their patients where treatment can continue in a safe and sterile environment should the facility be fully or partially damaged. Additionally, providers must be prepared to move communications and IT systems to an alternative location should onsite systems fail.
- Regional Disasters
Regional disasters also have a way of mandating and changing priorities rapidly. Although healthcare providers are prepared to handle an influx of patients, they need to create protocols specific to dealing with unusually large numbers of patients as the result of a local or regional emergency. For example, during September 11th , New York area hospitals needed to adjust both medical and business operations to receive hundreds of patients in a short amount of time.
- Voice Communications Plan
Recent events have highlighted the need for all healthcare providers to evaluate their voice communications plan. During the height of an emergency, staff and other emergency management stakeholders (EMTs, city officials, etc.) may only be able to communicate via low frequency VHF. If this is the case, across-the-board protocol and collaboration, even outside of the healthcare facility, should be established. In fact, hospitals must evaluate other options for effective communications during an emergency to best suit the institution's specific needs.
- Public Information/Notification
Before disaster strikes, healthcare facilities need to establish a public information plan outlining how vital information will be disseminated to patient families, the community and even the media. It should contain a list of what information will be released to who, when and via what method such as the facility's Web site or an emergency information call center located outside of the affected area.
- Vendors
Consider your key vendors as a resource during a crisis. Vendors can be important to the success of your business continuity plan by providing their services in preparation for, during and after the crisis. They may also be able to meet a need you have outside of their traditional scope of services.
Alternatively, vendors can hurt your plan. Asking critical vendors about their plans and capabilities to deal with emergencies is vital to operations. Crisis affecting a vendor could spill over if they are unable to provide services. If they do not have plans in place, alternative plans should be evaluated from beginning to end of the supply chain.
- Prepare, Practice and Revise
Review your healthcare facility's current plans for adequacy by testing them regularly. Pay close attention to facility additions/improvements, clinical systems, important data needed to continue care and business processes that may not have been included in the original plan.
Some questions you should ask as you update your plan are:
- Do you have a written crisis management procedures manual and do you follow it?
- Has it been tested recently?
- Have you evaluated your supply chain from beginning to end, paying special attention to new technology systems, business processes and vendors?
- Do your protocols and procedures reflect what you really expect your staff, from nurses to administrators, to do?
- Are your enterprise wide security procedures complete and current?
- How (and how well) are visitors and vendors controlled in your facility during a disaster?
Planning is simply a good business practice and should be part of the fundamental mission of any healthcare provider responsible to its employees, partners, patients and their families. Continually review the business continuity and disaster recovery plan for adequacy and currency.
The bottom line: healthcare providers need to be prepared. They need to tailor and test their business continuity plan for all potential circumstances – natural disasters, terrorist attacks, power outages, labor disputes and even computer viruses, especially with the increased reliance on technology for care.