Building Sustainable Business Continuity for Healthcare

How prepared is your healthcare organization to restore critical functions and services that have been disrupted?

“In order to support their staff and continue to deliver their services to their community, healthcare organizations need to do more to assess and mitigate business continuity risk and implement sustainable, appropriately scaled business continuity programs”
-Scott Ream

Imagine it is 5:00 AM and your facility manager just called informing you that your medical university laboratory facility located in the main hospital’s basement is under 14 feet of water.
Approximately 400 research projects have been adversely affected including many funded by significant grants to the institution. Many projects lost research materials that were irretrievable. Animal rights activists were outraged when the story leaked to the media. “In addition to the loss of animal models, there was significant loss of cell and tissue cultures, equipment including a brand new MRI, computers, diagnostic machines and associated data. Much of the data was irreplaceable and not reproducible.” Brad Goodwin, DVM, Center for Laboratory Animal Medicine and Care, University of Texas Health Science Center, Houston, TX, referencing Hurricane Allison, (June, 2001 in Houston, TX), www.lama-online.org/Brad1.html.

Although you may feel your organization is well prepared to recover from an adverse event, it is important to realize that your Joint Commission mandated Emergency Plan likely addresses only the first 96 hours of a major disruption and does not address how to restore critical functions, services and their support resources impacted by the event. In order to support their staff and continue to deliver their services to their community, healthcare organizations need to do more to assess and mitigate business continuity risk and implement sustainable, appropriately scaled business continuity programs.

Business continuity (BC) is the formal planning process that minimizes or eliminates the impact of events that disrupt critical business or clinical operations, functions, services and their supporting resources. This process integrates the following disciplines:

Emergency Management
Plans and actions to ensure health and safety, limit environmental impacts, and protect the organization’s assets. This includes Emergency Response, Crisis Management and Emergency Operations.

Clinical / Business Operations Recovery
Plans and actions to ensure continuity of critical clinical and business functions in the event of a disruption, crisis, emergency, or disaster. Implementation of viable risk mitigation and recovery strategies, and the development of operations recovery plans.

Technology Recovery
Plans and actions to ensure the ability to recover and restore Information Technology delivery systems, voice and data networks, and clinical and business applications and data before unacceptable impact of their loss occurs. This includes the implementation of viable risk mitigation and recovery strategies, and the development of Technology Recovery Plans.

Healthcare Continuity Planning in Action

BC Program Design & Deployment
In late 2000, the Kaiser Permanente Board of Directors set an objective to establish an enterprise-wide business continuity program to leverage the hard work they had done to prepare for Y2K. Since Kaiser Permanente already had an emergency management and technology recovery program the emphasis would be on clinical and business operations recovery planning.

Prior to the Y2K phenomenon, Kaiser Permanente’s planning for recovery and emergency management were viewed as synonymous. Today, the healthcare industry understands emergency management as a practical matter, and as a core focus of the regulatory bodies responsible for overseeing the industry. Communicating the differences between emergency management and recovery planning was an early challenge to the success of the program.
Skip Skivington, Kaiser Permanente's Vice President of Procurement Operations, was then responsible for business continuity as National Director of Healthcare Continuity Management.
Skip proposed seeking an external consulting partner to help design and deploy Kaiser Permanente’s new program. Through a request for proposal process, Virtual Corporation was selected. Later Skip said,” The committee made their vendor selection based on Virtual’s experience and understanding of Kaiser Permanente’s business needs, and their library of materials would dramatically accelerate the speed with which we could implement a sustainable enterprise wide program.”

Virtual’s BC program design methodology encompasses a scalable, proven 4-phase approach to build a BC program from scratch:

1. Design Program – Engage senior leadership in conducting an enterprise business impact analysis, define scope and program office requirements for the BC program and tailor Virtual’s core BC planning methods and tools for use at Kaiser Permanente. This phase resulted in a clearly defined and budgeted recovery planning program deployment strategy.
2. Prepare for Program Deployment – Assemble and train central program office resources as recovery planning experts, select and conduct initial clinical and business pilots and finalize methods and tools for pilot and full-scale deployment. 
3. Deploy Program – Organize program office resources into two person deployment teams, prioritize targeted sites and functions into projects, assign teams to these projects and manage deployments through completion. Leverage the pre-populated pilot plans at every Kaiser Permanente Medical Center as ”starting point” plans across all of Kaiser Permanente. The project teams had greater than 95% participation. 
4. Sustain Program – Transition program office staff into an ongoing support and program enhancement role. Establish periodic plan update, test and maintenance procedures. Reinforce local ownership of each department’s recovery plan. Establish training and program enhancement goals each year. Since 2003, five Business Continuity professionals staff the Kaiser Permanente National Business Continuity Department.

Our 4-phase method and tools are easily adapted to healthcare organizations of any size and scale. We adapt our methods and tools to fit the client’s needs, culture and budget rather than forcing clients to fit into an inflexible approach as offered by some of our competitors.

Sustainable Planner® Helps Kaiser Permanente Achieve Program Sustainability

At the beginning of the Phase 2 pilot, Virtual helped Kaiser Permanente select a popular planning software tool and began using this tool in manager training sessions. It quickly became obvious that there was a problem. The managers objected to having to go to two days of training to use software that they will only access a few times a year.

This tool, like all of the BC planning tools available at the time, was developed by organizations who shared a common philosophy, “BC professionals do BC planning for the organization”. As such, these tools have powerful capabilities easily accessible to the BC planner. But they require days of training to learn to navigate and use of this capability. At Kaiser Permanente, this was a “show-stopper”.

I remember walking into Skip’s office and telling him I had good news and bad news. The good news was we would successfully get the initial plans written across Kaiser Permanente. The bad news was that no one would use the planning tool to update their plans after we left. We proposed designing a tool that would simplify planning by clinicians and business professionals.

Over the next 18 months, we worked with a team of developers provided by Kaiser Permanente’s IT department and Sustainable Planner® (SP) was born. The existing planning data was migrated into SP and went into production in October, 2003.
Since that time, Kaiser Permanente has gained significant experience with Sustainable Planner® and recently offered the following statistics to Virtual’s Technical Services team:

• Over 9,000 departmental plans are maintained
• Over 10,000 users have access to the single instance of SP in production at Kaiser Permanente
• Average user training (department managers mostly) takes less than one hour and users have greater than 95% retention of what they learned 12 months later

Through our experience with Kaiser Permanente, we realized that there was a substantial gap between available software and what healthcare organizations needed – a tool that would make it simple to create BC planning templates that clinicians and business professionals can use to populate and maintain their own BC plans.

Virtual Corporation has developed a comprehensive library of easy to use templates for our Healthcare clients:

• Healthcare Operations Recovery - over 90 unique, pre-populated departmental templates are available for a broad cross-section of hospital healthcare delivery and administrative functions. This template provides business impact analysis (BIA), recovery strategies, recovery resources, dependency analysis, recovery and call lists and extensive healthcare specific recovery resource schedules.
• Healthcare BIA - for hospitals simply looking to create and maintain business impact information, this template addresses the IT application and process dependencies and assesses the current state of preparedness.
• IT-Disaster Recovery - a standardized healthcare IT plan format which can be used as a single plan for the entire IT department, or multiple users could each create IT DR plans for their respective area such as Network, Server, Database, Help Desk and more.
• SP-HVAdvantage™ - an innovative template created by Virtual Corporation that marries a traditional Joint Commission hazard vulnerability analysis with Virtual's comprehensive Healthcare BIA. www.virtual-corp.net/html/program_assessment.html Provides the user with the unique SP-Risk Score™ which quantifies departmental preparedness risk at each site.
• Business Continuity Maturity Model® Self-Assessment – Virtual Corporation is the creator of this globally recognized standard for business continuity program assessment. Using the BCMM® Self-Assessment template, users gather information about each of the BC program criteria and SP generates a BCMM® Scorecard with self-documented gap analysis report. These invaluable tools help organizations assess exactly where their BC program is today and prioritize the most effective actions that will advance their program with quantifiable results.

HVAdvantageSM Utilized by Deaconess Health System

There are compelling reasons to perform a more rigorous HVA than is customarily performed in healthcare organizations. The goal is to reduce the possibility of facility infrastructure damage, the impact on the community including limiting level and extent of care, evacuation of patients and the impact on surrounding healthcare delivery facilities. In response to this need, Virtual has developed an expansion of the traditional hazard vulnerability analysis (HVA) mandated by the Joint Commission and other hospital accreditation agencies.

Virtual Corporation was chosen as the business continuity consulting partner for Deaconess Health System (DHS) in Evansville, Indiana. The initial engagements focused on conducting an integrated business continuity and IT technology recovery current state assessment, inventory, vulnerability analysis and technology optimization review.

One of the Steering Committee members from DHS is Tom Barnett, Manager of Engineering and Maintenance for all of DHS. “Tom and I had the opportunity to discuss Virtual’s work with another client where we conducted an extensive systems dependency analysis as part of a manufacturing plant BC planning project”, remembers J.R. Hildreth, Virtual’s Vice President of Consulting Delivery, a trained nurse with 25+ years in hospital and pharmaceutical industry experience prior to joining Virtual. “Tom lit up when we showed him the systems dependency map Virtual Corporation had created. He immediately saw the connection to how this could be used to analyze DHS hospital systems.”

The Deaconess Main Hospital Engineering and Maintenance Risk Assessment project was comprised of four major segments:

1. Update the traditional HVA from 2007 encompassing Virtual’s “enhanced HVA” elements
2. Conduct a 192-question facility risk management assessment across 8 risk domains:  a. Insurance Coverage
   b. Facility Location
   c. Personnel Protection
   d. Asset Protection
   e. External Security
   f. Internal Security
   g. Physical Environment
   h. Contingency Plans
3. Conduct a facility systems risk and dependency assessment which reviewed all critical infrastructure systems and produced a Facility Systems Dependency Matrix, Facility Systems Preparedness Scorecard and Technology Risk Matrix 
4. Create and present an executive Findings Report which organized all findings and recommendations into a digestible and actionable format.

The HVAdvantageSM assessment took 10 weeks to complete. The valuable reporting resulted in Virtual being contracted for a follow-on risk assessment of the Gateway hospital complex.
“We saw immediate and useful information from this assessment”, said Mr. Barnett when asked about the project. “Our Gateway facility is about to undergo an extensive, multi-million dollar construction expansion and it occurred to me that it would be extremely valuable to apply the HVAdvantageSM methodology at the front end of this construction project to yield useful suggestions for engineering risk mitigation into the plant, rather than retrofitting those same or similar solutions after the fact.”

Getting Started

If your organization does not presently have any recovery planning capabilities in place, you may be wondering How do we get started? Are there any simple actions that can help us get underway on our own?  Fortunately, the answer is ”yes”. Here are a few suggestions to get started.

Recommendation #1: Work with the leadership team to define a compelling business case or justification for undertaking business continuity at this time. Below is an example of a message Virtual developed and honed across a number of healthcare institutions:

• Why do Business Continuity now?
  o Right thing to do for our staff and communities
  o Enhances our ability to avoid or limit:
      • Patient service interruption
      • Financial losses
      • Regulatory fines
      • Damage to equipment
  o We live in a more dangerous world
  o Ensures compliance with increasing regulatory requirements

Recommendation #2: Give thought to what level of resource commitment is appropriate and required to build a sustainable BC capability within your organization. Keep the following examples in mind:

• Kaiser Permanente
  o Over 9,000 department BC plans supported in SP
  o 5-person dedicated Business Continuity Department
  o 3-year deployment in 4 phases
• MD Anderson
  o Over 200 BC & IT-DR plans supported in SP
  o 2.0 FTEs in 3-person BC department
  o Migrated from MS Office® plans
• UT Southwestern Medical Center
  o Over 250 BC plans supported in SP
  o 1.5 FTEs in 3-person BC department
  o Migrated from MS Office® plans
• Medical University of South Carolina
  o Over 150 BC plans supported in SP
  o 1.5 FTEs in 4-person Risk Management department support BC planning
  o Launched BC plans from scratch using SP

Establishing an appropriately scaled BC program will help ensure your continued service to your community and minimize the financial impact during a disruptive event. Although emergency response is highly developed in healthcare, there is significant opportunity to be able to resume full operations efficiently and cost effectively.

About the author
Scott Ream is the president and co-founder of Virtual Corporation, principal author of the BCMM®, a founding member of the International Continuity Oversight Board and a principal member to the US TAG to TC223, Societal Security. For more information visit www.virtual-corp.net or call 976-426-1444.

About the company
Virtual’s Healthcare Continuty Suite^TM is comprised of the following products and services:
BC Program Design and Deployment – Whether starting from scratch or looking to enhance an existing program, Virtual’s 15 years of BC program design and deployment experience ensures that your healthcare institution’s investment in a business continuity program will be prudent, practical and sustainable.

Sustainable Planner® – Virtual’s ground-breaking BC planning tool which requires less that 1 hour of training to create BC plans. SP includes customizable templates and over 90 pre-populated healthcare delivery, support and administrative departmental operations recovery plans to jumpstart planning.

HVAdvantageSM – an enhanced hazard vulnerability assessment that meets the Joint Commission annual HVA requirement and identifies risk and mitigation recommendations including a “deep-dive” risk assessment and dependency analysis of your critical hospital facility systems.

Healthcare Business Impact Analysis (BIA) – Virtual’s consulting method and tools to engage clinical and business senior leadership and operations management to quantify and qualify the amount of time critical operations and dependencies can be disrupted before they must be restored.

BC Program Assessment – Virtual published the Business Continuity Maturity Model®  (BCMM®) in 2003 to assist organizations worldwide to objectively assess their current state of preparedness. It provides a roadmap (gap analysis) to an enhanced state of preparedness consistent with management objectives and available resources. With the BCMM®, program assessments are achieved in either of two ways:

1. On your own, you can either use Virtual’s free BCMM® self-assessment tool downloaded from Virtual’s website www.virtual-corp.net/html/bcmm.html or send your BC professional(s) to the 2-day licensed assessor training taught by Virtual’s training partner ICOR http://theicor.org to conduct rigorous assessments of your BC program.
2. With Virtual’s support led by a licensed BCMM® assessor, conduct either a facilitated BCMM® self-assessment or a more rigorous BCMM® review.