1. No category

Devlen:JCH page.qxd 04/12/2009 12:22 Page 47
Journal of Business Continuity & Emergency Planning Volume 4 Number 1
How to build a comprehensive
business continuity programme for a
healthcare organisation
Angela Devlen
Received (in revised form): 14th September, 2009
Wakefield Brunswick, 276 Washington Street, #338, Boston, MA 02108, USA
Tel: +1 617 710 4439; E-mail: [email protected]
Angela Devlen is Managing Partner of
Wakefield Brunswick, Inc., a management consulting firm specialising in disaster preparedness, business continuity and healthcare
management. Prior to that, she was Director of
Emergency Management at Caritas Christi
Health Care.
ABSTRACT
Since 2005 there has been an ongoing examination of the impact of disasters on hospitals,
with specific interest in those rendered inoperable or seriously crippled operationally and financially. Following several evaluations of these
events and the publication of several reports
detailing gaps in preparedness, more is known
about the impact to hospitals directly affected by
emergencies and catastrophic events. As a result,
there have been continued updates to regulations
and standards. However, a significant gap
remains in the establishment of a model representing true integration of risk management
practices within hospitals. This paper discusses
one approach to addressing that gap through
building a comprehensive business continuity
programme for healthcare organisations. This
programme is intended to result in a roadmap
towards resilience in the face of the many risks
faced by hospitals today.
Keywords: healthcare, hospitals, emergencies, disasters, business continuity
planning,
(COOP)
continuity
of
operations
SETTING THE STAGE
After the levees broke in New Orleans in
2005, hospitals were rendered inoperable,
Louisiana State University lost 8,000 lab
animals, and New Orleans colleges lost
US$150m in federally funded research.
Following Hurricane Ike in 2008, there
were layoffs and a subsequent lawsuit at
University of Texas Medical Branch at
Galveston.1 The ice storms during the
2008/09 winter season caused significant
healthcare delivery challenges in the
Midwest and North-East, and many areas
suffered significant power outages. Most
healthcare organisations in these areas have
emergency management plans. Several of
them also have disaster recovery plans for
their information technology infrastructure. In some cases, however, this was not
enough, and some institutions have come
under intense scrutiny.
It has been argued that current federal
funding has created a number of stovepipe programmes that remain poorly integrated and evaluated.2 Faced with the
mounting crisis in hospital operating theatres and emergency departments, it is difficult to create the scalable solutions
necessary for today’s emergency manage-
Journal of Business Continuity
& Emergency Planning
Vol. 4 No. 1, pp. 47–61
Henry Stewart Publications,
1749–9216
Page 47
Devlen:JCH page.qxd 04/12/2009 12:22 Page 48
How to build a BCP for a healthcare organisation
Figure 1
Healthcare
resiliency: an
integrated approach
of several
disciplines
Business continuity
Disaster recovery
Security/safety
Crisis
communications
Risk
management
Emergency management
ment and business continuity plans
(BCPs). Yet it is essential to develop the
critical infrastructure necessary for day-today emergencies in such a way that it can
be scaled up to meet the needs of larger
and more severe emergencies.3 The US
Department of Health and Human
Services (DHHS) and Department of
Homeland Security have recommended
that critical infrastructure and key
resources (CIKR) develop BCPs.
Guidance was issued by DHHS to business
and healthcare in response to the H1N1
outbreak,4 yet no formal BCP standards or
model for implementation exist for
healthcare. So how should business continuity be approached and how does it
differ from emergency management?
ALIGNING BUSINESS CONTINUITY
WITH HEALTHCARE RESILIENCY
Healthcare resiliency sits at the centre of
an integrated approach of several disciplines (Figure 1). A comprehensive
approach looks at measures taken to
Page 48
ensure the continuity of critical business
and clinical operations during an interruption or disaster, as well as the recovery and
resumption of normal operations of the
healthcare delivery systems. Business continuity planning is not solely about planning for the next sudden influx of patients
(a surge plan) but also is about an integrated approach in preparing for a wide
variety of events that may harm biomedical and IT systems, the physical plant,
patients and staff.
In the case of one state striving for hospitals to establish continuity of operations
plans, hospitals were required to include a
number of new elements in their emergency management plans, such as identification of essential functions necessary for
continuity of operations and provision for
devolution of essential functions should
movement to another geographical location be required.
The state also suggested plans should
include documentation of critical systems;
the hospitals’ capacity to perform essential
functions given specific losses of staff and
Devlen:JCH page.qxd 04/12/2009 12:22 Page 49
Devlen
expertise; services and infrastructure alternatives; and disaster recovery needs with
respect to communications and information systems. This reaches beyond the mass
casualty focused plans of the past. As
organisations continue to review lessons
learned from events of recent years, it is
becoming increasingly clear that, with
tight operating budgets, narrow profit
margins and increasing healthcare costs,
the financial and operational impact of
adverse events is causing more hospitals to
reexamine the approach and effectiveness
of their current preparedness and contingency planning.
DEBILITATING MYTH
Hospitals are commonly perceived as
being good at emergency response;
indeed, given the challenges they face on a
daily basis, in many cases they outperform
reasonable expectations. Nonetheless,
existing emergency response plans have on
a number of occasions proved inadequate.
Plans focused on mass casualty incident
planning alone do not provide a holistic
approach to managing risk. Such plans fail
to deliver a real strategy for mitigating the
internal impact of events or comprehensive response to events requiring an accelerated and streamlined response.
There is a misconception that current
‘internal’ disaster plans address the requirements of a BCP. Several emergency management programmes lack procedures for
continuity of critical operations or recovery from an event. In October 2007, a
survey of 1,055 healthcare facilities, with
support from the Business Continuity
Planning Workgroup for Healthcare
Organizations (BCPWHO), was conducted to assess the level of preparedness
from the perspective of US healthcare
facilities.5 This survey was the first national
benchmarking survey addressing both
emergency management and business
continuity for healthcare. Across the
healthcare system, the research identified
several areas of weakness in day-to-day
operations that become magnified during
an emergency and during the recovery
phase. This was further illustrated by the
comments regarding the 193 separate incidents that resulted in the activation of
emergency operations centres over a
three-year period (2004–07).
The results indicate that most healthcare organisations, including but not limited to hospitals, long-term care facilities
and healthcare centres, are struggling.
While there are some successes, few know
of appropriate avenues to share their success. Planning is being conducted in
response to either mandates or vulnerability analyses, which are left open to interpretation, resulting in inconsistent
implementation. There is a recurring
request for standards or guidelines to
define health system BCPs including
nationally accepted metrics and performance measures.
The goal of the present paper is to provide that starting point and offer guidance
on how to develop a programme.
REVOLUTIONARY POTENTIAL
Between 1993 and 2003, visits to US
emergency departments (EDs) increased
by 26 per cent, to a total of 114 million
visits annually.6 At the same time, the
number of US EDs decreased by more
than 400, and almost 200,000 inpatient
hospital beds were taken out of service.7
ED overcrowding is a nationwide problem
affecting the preparedness and safety of the
healthcare system.
As a result, hospitals are actively seeking
models for patient flow, the management
of daily surge capacity needs and developing operations improvement initiatives to
streamline processes while reducing costs
and patient risk. The integration of disci-
Page 49
Devlen:JCH page.qxd 04/12/2009 12:22 Page 50
How to build a BCP for a healthcare organisation
Table 1: How the phases of emergency management can be aligned with the components of business continuity
Emergency management phase
Business continuity component*
Mitigation
Risk assessment
Business impact analysis
Developing business continuity strategies
Developing and implementing business continuity plans
Awareness and training programmes
Maintaining and exercising plans
Crisis communications
Coordination with external agencies
Emergency response and operations
Components of emergency response
Roles and responsibilities: incident command
HICS and the business continuity branch director
Emergency operations centres
Plan activation
Recovery and resumption of normal hospital operations
Preparedness
Response
Recovery
*According to DRII Professional Practices
plines that are stakeholders in these initiatives, along with a business continuity
strategy that uses business impact analysis
data, can go a long way to strengthen an
emergency management programme as
well as support hospital operations
improvement initiatives.
It is not only the mass casualty scenario
with which hospitals need to be concerned. Indeed, as preparations for the
autumn influenza season begin, many
examples of lessons learned have emerged
since the start of the H1N1 outbreak.
Following assessments of several hospitals
and health systems, preliminary findings
point to recurring planning gaps in areas
such as human resource policies, communications, supply-chain procedures and
tracking capabilities with regards to personnel, vaccines and critical supplies. This
demonstrates opportunities for process
improvement and clinical processes
beyond ED operations. Here is where
business continuity holds enormous
potential.
Among the thousands of comments
from the BCPWHO survey respondents,
two broad themes emerged: first, the need
Page 50
of understanding the role of business continuity to build a business case; secondly,
the need for the methodology and tools to
accomplish this work.
To start, Table 1 provides a simple illustration of how emergency management
phases can be aligned with the professional
practices of business continuity.
Next, the organisation’s need for a BCP
can be determined. To know if the organisation needs to consider business continuity, conduct a brief assessment to
determine how comprehensive the current plan is:
• Can the organisation still write cheques
if the finance staff have to be relocated?
• Consider if the catheterisation lab, surgery or outpatient areas were inaccessible or if there was a fire in the
pharmacy or a flood in the clinical labs
area. How would the organisation
resume normal business operations?
What would be the financial and
patient care impact?
• Does current planning address the
impact of events such as the lives of staff
lost due to significant mortality-associ-
Devlen:JCH page.qxd 04/12/2009 12:22 Page 51
Devlen
ated injury or disease, or the need for
some workers to attend to family illness
or to children remaining at home due
to school closures or an emergency
condition that may require the transfer
of essential functions to other personnel
or possibly relocation site(s)?
• Does the plan outline a comprehensive
approach to ensure the continuity of
essential services during an event,
ensuring the safekeeping of records vital
to the hospital and its patients, emergency acquisition of resources necessary
for business resumption, and the capabilities to work at alternative sites until
normal operations can be resumed?
A ROADMAP: APPROACH AND
DELIVERABLES
Governance
When a world-renowned ambulatory
cancer care and research institute wanted
to improve its existing emergency management plans to mitigate risk to patients,
staff and institute operations, it developed
a BCP.8 Integration between research and
clinical care through clinical trials had
become more complex, and the institute
was becoming increasingly dependent on
information technology. In order to
manage risk in this rapidly-changing environment, it was essential to improve the
institute’s ability to maintain its delivery of
care to patients during critical incidents
affecting the institute.
However, business continuity in healthcare, particularly among providers, was not
well established. This left the institute on
its own to develop a model that addressed
the unique challenges it faced. Unlike
other industries which, during time of disaster, can relocate operations to an alternative site, healthcare providers need to
maintain operations, if not increase their
capacity. A programme with an integrated
approach to addressing emergency management, business continuity, IT and physical security, and disaster recovery was
therefore necessary.
Governance was seen as a key starting
point for the project manager and the
chief operating officer. Together they created a project team and steering committee to spearhead the effort. The steering
committee included the functional area
vice presidents, the chief nursing officer
and the chief information officer. The philosophy was based on the concept that
leaders have to worry about business continuity and knit it into other work at their
organisation, particularly people who deal
with safety, operations and security.
Integrating BCP with the organisation’s
business, as opposed to a function off to
the side, not only provides a strategy for
risk mitigation but also for business effectiveness.
Assessment
The assessment dimension may be the
most fluid in regards to style and approach.
The hazard vulnerability analysis (HVA)
methodology has been described as subjective and not always a true reflection of
risk. Yet it is a required annual exercise for
Joint Commission accredited facilities.9
With business impact analysis (BIA), previous methods have been difficult to translate when developing and conducting a
questionnaire process for clinical and
research areas.
Understanding the impact on patient
care and patient safety, in addition to
financial impacts, continuously raises the
question of how to measure it. Redefining
the meaning of recovery timeframes in
patient care settings is a recurring challenge as the traditional ‘relocate critical
functions and recover’ strategy does not
translate easily to intensive care units.
To address the challenge of the ambiguity and subjectivity of the HVA, some
Page 51
Devlen:JCH page.qxd 04/12/2009 12:22 Page 52
How to build a BCP for a healthcare organisation
urban areas have formed coalitions of hospitals to collaborate on preparedness. In
the case of Boston and Pittsburgh, for
example, the hospitals selected and agreed
to use a single HVA tool. Research was
conducted to predetermine the probability
scores of the various risks so that, as a
region, the hospitals were measuring probability in a consistent manner. This meant
the remaining HVA could then be completed in either of two ways: (1) a subcommittee could complete a regional-level
HVA so that each hospital facility could
benchmark its own risk level against the
regional risk profile; or (2) the hospitals
could take the standardised HVA with the
pre-populated probability data and complete a facility-based risk profile for submission to the coalition. As all area
hospitals were using the same tool, this
collection procedure allowed for the data
to be aggregated and rolled up to produce
a regional risk profile.
Hospitals are increasingly turning to
BIAs. A typical ten-step BIA for healthcare settings would be as follows:
1. Scope definition.
2. Design standard data set (recovery
times, applications, rating menu of
scores from 1 to 5, etc).
3. Pre-establish recovery time objectives
(avoid free-form text by using dropdown menus).
4. Identify impact categories (financial,
reputation, research or clinical regulatory requirements, patient care, patient
safety and/or patient satisfaction).
5. Design questions.
6. Run an informational workshop.
7. Conduct
interviews/one-on-one
meetings.
8. Aggregate data.
9. Organise and prioritise findings.
10. Create reports.
The challenge has been to transfer a
Page 52
process originally designed for private
sector businesses into a patient care setting. Understanding that the BIA is a new
process to many organisations, it is recommended that the questions should aim to
gather very specific data, rather than
attempt to answer every possible question
the first time around. Choose a few specific areas such as identifying critical functions, dependencies, vital records and
reliance on information technology.
When developing the questions for the
BIA, consider exactly what information is
required and how it will be reported. This
is an important agenda item early on for
the steering committee.
How will the impact of a disruption to
a function be measured? Discuss impacts,
not probability, and be consistent about
the value being measured (eg by the
hour, by the day) and if measuring by
function or department. Rather than
estimate the impact, ask questions that
allow the data elements to be used in calculations that produce reports with more
accurate data.
In the case of one national healthcare
system, the following questions were
asked:
• What is your daily departmental revenue?
• What is the percentage productivity loss
during outage per day?
• What is the percentage of revenue lost
(non-recoverable) per day?
• What are your average annual employee
costs?
This allowed production of the following
reports:
•
•
•
•
•
average cost per hour worked;
average cost per employee day;
lost productivity per employee;
daily revenue loss;
total cost of lost employee productivity;
Devlen:JCH page.qxd 04/12/2009 12:22 Page 53
Devlen
• total revenue loss during outage (which
was graphed showing losses over time).
Adhere to questions that result in measurable data to populate reports and use predetermined data sets. Deviating from this
methodology will compromise data
integrity. Avoid highly subjective questions such as ‘what is the maximum
amount your process/department could be
unavailable?’ It is preferable to create
reports to measure impact and use that
data for decision support, rather than have
a department estimate how long it could
be unavailable.
Respondents should select from a dropdown menu of values rather than enter
free-form text. By providing a rating, such
as patient impact or the risk of a critical
function being unavailable, it is possible to
run ratings-based reports for the different
functions and prioritise them with the
steering committee.
Once there is confidence in what the
steering committee expects to be reported
and the questionnaire is designed and
tested, conduct workshops allowing representatives from each department to understand the project and the data to be
gathered prior to the distribution of the
questionnaire. After the BIA is distributed,
meetings may also be held with individual
departments to gather the data to complete the questionnaire. While labourintensive, this pays off as it increases
awareness, understanding and governance.
When this process was followed during a
BIA for a large healthcare system, participants provided data that were significantly
more useful than if they had completed
the questionnaire without guidance.
The BIA is also useful for dependency
mapping — the documentation of vital
elements of the organisation. Dependency
mapping presents a greater opportunity to
support improvement initiatives for key
operations. What better way to use the
BIA than to demonstrate single points of
failure as well as the potential for unnecessary redundancy and risk currently built
into clinical processes? The data can then
be analysed and presented to the BCP
steering committee where decisions can
be made on priorities, risk mitigation
measures and the scope of the programme.
The BIA provides an interesting insight
into the vast array of vital elements that
are required in a healthcare and research
environment, including:
• Elements for research
— crystals;
— vials of plasma/serum/cells — biohazard considerations required for
salvage operations;
— unique mouse strains;
— chemistry and haematology analysers.
• Equipment
— personal protective equipment for
HAZMAT response.
• Paper-based records
— written clinical records;
— personnel documents;
— rare books, journals;
— researcher notepads.
In healthcare, it is not simply a question of
ensuring the availability of workstations
and alternative workspace, but also the
relocation needs for research labs, pharmacies, clinical labs and more.
Strategy
While there are several new standards and
recommendations in the various published
reports, two things surface time and again
— the healthcare sector knows what it is
not doing in healthcare preparedness, but
it is not clear exactly where it stands and
how to accomplish the reoccurring recommendations. This is especially true with
respect to business continuity.
Page 53
Devlen:JCH page.qxd 04/12/2009 12:22 Page 54
End
user
How to build a BCP for a healthcare organisation
Support Centre
contacted (phone,
e-mail. or web)
NetOps
Problem /incidence
occurrence
Incident closed
Ascertain details,
scope and impact
of problem via
internal IS triage.
Updates GS ticket.
Internally
discovered
problem
Support centre
GS ticket assign to
responsible group
Receives problem
(call , e-mail , web)
Incident
critical or broad
enough to page
responsible
group? (2)
Questions user on
details , scope and
impact of problem
( questions to be
developed ) ( 1 )
Page appropriate
on-call pager using
Escalation Matrix
( 3)
Yes
A
B
Incident impact
on patient care
>30 min?
Yes
NetOps, Tech
or Apps Analyst
No
A
Page received and
acknowledged
Review ticket and
begin analysis
Incident worked on
B
Update SC
outgoing phone
message ? (5)
Figure 2
Downtime
communication
process
Has incident
expanded to
more than one
entity?
Yes
After action report/
review and
periodic ticket
reviews to look for
trends
No
Yes
IS mgmt and
Incident
Communicator
discuss next level
of escalation
HSAMs
Incident
communication
IS mgmt.
Problem
needs to be
escalated? (7)
Page 54
Yes
Resolved
Yes
Hourly conference calls held
for the duration of the
incident and users updated
hourly until resolved
Initiate conference
bridge ( 800 -866 0549 ID 8984040 )
(Technical,
communication
and Bus. Impact)
( 9)
Send out e-mail,
pages, NetHail
messages, and/or
phone call as
appropriate to
users and IS (96)
Notify HSAMs and
IS Sr.
Mgmt . ( means
TBD )
Two key elements will drive future
strategy and further development of a
recognised methodology. This effort has
been undertaken by the Disaster
Recovery Institute International (DRII),
and at the time of writing, preparations
were underway to launch the DRII curriculum and certification for healthcare
business continuity planning. The second
element is industry data analysis and
benchmarking.
Using
the
2007
10
BCPWHO survey and the 2009 international benchmarking survey by BC
Management,11 which includes a customised healthcare report, it is possible to
leverage the experience of others
described in the present paper along with
the latest in education and benchmarking.
Communicate to
local entities
(problem,
anticipated length,
impact, etc) (10)
Work with entity
management to
determine if EMP
process needed
Notify end users of
All Clear (e-mail,
NetHail,
phones, etc)
Together they take the profession to a
new level in healthcare.
In the case of the cancer centre, following the BIA presentation to the steering
committee, it was determined that, of the
62 departments, which include clinical,
research and business departments, in addition to information services and telecommunications, the ten most critical
departments
(Pediatric
and Adult
Ambulatory Care, AIDS and Immunology
Research, Network Affiliates, Core
Clinical Laboratories, Environmental
Health and Safety, Health Information
Services, Experimental Medicine, Access
Management, and the Animal Research
Facility) would have comprehensive plans
built out, with the remaining 52 creating
Devlen:JCH page.qxd 04/12/2009 12:22 Page 55
Devlen
shell plans to be built out as the programme matures.
At this stage, do not neglect to integrate
the BCP with emergency management
and disaster recovery. Collaborate with the
emergency management director and discuss what currently exists for departmental
plans. When the team began looking at
the ten departments listed above, they
were quick to understand what previously
existed and where there were opportunities to integrate the two. As the chief
information officer sat on the steering
committee, he was able to see the order of
priority of the more than 100 applications
his team supported and later drill down to
the critical top 10 per cent when making
decisions about disaster recovery strategies
and assessing their IT capability against the
now documented functional requirements.
As hospitals begin to assess departmental strategies, discussions often centre on
the reality that space is always at a premium and a traditional hot-site is insufficient for relocation of functions outside of
IT. Mutual aid agreements with other labs,
hospitals and universities must be considered. It is essential to consider all vital elements for operations as well as access to
systems. Gaps are occasionally discovered,
such as the lack of downtime procedures
in the event applications are unavailable.
So back-up paper copies are kept or recreated to write patient orders and admit
patients. Communication and integration
of incident command structures between
hospitals and IT can go a long way
towards resiliency, particularly in the case
where IT is outsourced or a corporate
function within a health system. In the
case of the process used by a health system
in Figure 2, once the affected entities are
notified, Information Systems (IS)
becomes part of the incident command
team at the hospital as the hospital then
activates its core emergency management
team and they collectively strategise via a
conference call.
In the case of the Children’s Hospital of
Philadelphia (CHOP), the BCP is integrated by engaging the clinicians responsible for patient care through their Monthly
Downtime Task Force, which is made up
of about 50 people from both the clinical
and corporate sides.12 Additionally, CHOP
actively tests strategies and tactics for dealing with planned and unplanned downtime by performing many tabletop disaster
scenario exercises, including one very
large exercise with 25 clinicians and business people and 55 IT people.
To mitigate the likelihood of downtime, many hospital systems have redundancy built into them. In the 2007
BCPWHO survey, 62 per cent of healthcare organisations surveyed had comprehensive disaster recovery plans.13 To
provide an enhanced application continuity solution, the most critical systems use
high-availability storage and applications
like Provider Order Entry and the
Longitudinal Medical Record run on
platforms that are completely replicated
across the two data centres.
Unlike businesses running a 9-to-5
operation, healthcare providers typically
need their mission-critical applications to
be available 24/7. Less critical applications
with a 24 or 72-hour recovery time objective are candidates for drop-ship solutions
or the use of servers that are housed in
racks in an alternative data centre ready to
be built on the fly in the event they are
needed for recovery.
Execution
When one urban hospital was doing a
complete overhaul of its emergency management plan, it looked for a way to collapse several separate plans into one. It had
a hospital incident command system
(HICS) manual; a continuity of operations
plan that was based on the presidential
Page 55
Devlen:JCH page.qxd 04/12/2009 12:22 Page 56
How to build a BCP for a healthcare organisation
directive14 but not yet a customised BCP;
the emergency management plan; separate
policies in random manuals; and a separate
and disconnected IT disaster recovery. To
accomplish its goal, it therefore created
one main binder for the emergency operations plan (EOP) that included various
sections laid out and aligned with the
HICS. For example, as the casualty care
unit leader reports under the medical care
branch director within operations, so there
is an operations section to the EOP and
the medical care branch tab details the
procedures for the ED. Like most departments, it includes at a minimum the following:
• updated ED plan with added evacuation/holding area procedures;
• HICS chart;
• casualty care unit leader job action
sheet;
• call lists for staff and critical vendors;
• patient tracking form for evacuation;
• patient care unit assessment form (rapid
assessment
of
operational/clinical
impact and needs for continuity of critical functions);
• downtime procedures for critical IT
systems.
Further business continuity procedures are
also included in the operations section of
the EOP under the business continuity
branch. For plan element considerations,
please see the appendix.
For any programme to be successful, an
awareness and training programme is
needed, as well as a schedule for maintaining and exercising the plan. Take exercises
beyond the Joint Commission standards
and be sure to include departments such as
clinical support services, surgery and facilities as well as external agencies. Move
past the mass casualty scenarios that test
only emergency department response and
consider scenarios that result in adverse
Page 56
impact to hospital operations and patient
care.
CONCLUSION
It is hoped that this paper will begin
moving emergency management from
being a compliance exercise to an evidence-based planning and health system
that is truly prepared to meet any disruptive or interruptive possibility. This will
lead to necessary action to effect changes
and bring about more resilient healthcare
preparedness across the board.
APPENDIX: CONSIDERATIONS FOR
HOSPITAL BUSINESS CONTINUITY
Business continuity plan activation
• Review of mission-critical functions for
the organisation.
• Evaluation of current staffing levels and
resource deployment.
• Notification of human resources, managers, union representatives and other
key personnel as to status and plan
implementation.
• Notification of employees as to plan
activation and process.
• Implementation of alternative staff
resource options.
• Evaluation of immediate and ongoing
staff needs based on existing and predicted levels of available human
resources.
Operational considerations
Staff resources
The objective of this plan for human
resources is to ensure the execution of the
hospital’s essential functions during any
crisis and to provide for the safety and
wellbeing of employees during any emergency when a sudden or ongoing and
severe reduction in patient care services or
Devlen:JCH page.qxd 04/12/2009 12:22 Page 57
Devlen
in staff/human resources critical to the safe
and effective operation of the organisation
threatened occurs. Specific objectives of
this plan include:
• ensuring the continuous performance
of essential functions during an emergency;
• protecting the safety and productivity of
working staff;
• reducing or mitigating disruptions to
operations;
• addressing behavioural health issues that
may affect the organisation;
• planning for potentially critical losses of
staff through scheduling, identification
of alternative resources, and temporary
business reduction efforts;
• reducing loss of life and minimising
damage and losses;
• achieving a timely and orderly recovery
from an emergency and resumption of
full service to customers;
• evaluation of current staffing levels and
resource deployment;
• onsite management of staffing levels by
the administrative manager, delegated to
department heads as needed every four
hours.
In preparation for the coverage needed in
the event of a reduction in staffing or
insufficient staff resources due to demand,
cross-training should be provided to floor
medical/surgical nursing staff, and
advanced credentialing of physicians,
nurses and other clinical professionals from
non-essential disciplines to supplement the
critical departments should be initiated.
Clinical professionals would include:
• physician groups, such as gastroenterology, plastic surgery etc;
• retired MDs living in the community;
• schools of nursing (obtain student contract agreements);
• retired nurses;
• school nurses in the community;
• alumni nurses;
• contract personnel.
Personnel considerations
• Evaluate potential health and safety
issues.
• Identify alternative staff options (eg
contractors or other staff options that
may alleviate problems resulting from
staff loss).
• Consider utilisation of staffing resources
from within the community or health
system as the priority, then contracted
agencies as needed.
• Identify alternative work options available through ‘telecommuting’ or other
offsite possibilities.
• Select non-clinical personnel who can
be given the option of working offsite
(at the discretion of the designated
administrative manager).
• Collaborate with IS to plan remote
access process and identify applications
needed.
• Assess which applications have the
capability of remote access, eg
Meditech, ANSOS, Microsoft Outlook
and Word.
• Give written notification to employees.
• Assess union issues surrounding overtime issues and disaster support/sharing
of responsibilities among workers.
• Meet with union representatives to discuss relevant issues, such as:
— language for asking staff availability;
— offering incentive programmes;
— utilising external agencies;
— reviewing four-hour mandatory
rule.
• Plan to re-deploy staff as needed, offering staff cross-training in specific areas.
• Assess extra resources within hospital
and within health system.
• Train workers on an annual basis with
regard to contingency planning and the
need for personal backup plans for
transportation, family needs, etc.
Page 57
Devlen:JCH page.qxd 04/12/2009 12:22 Page 58
How to build a BCP for a healthcare organisation
• Assess core competencies of all employees.
• Identify similar core competencies that
exist, for example, endoscopy, post
anaesthesia care unit (PACU), catheterisation lab, etc.
• Provide cross-training of staff with similar competencies.
Family needs
• Offer support to employees, child care
centre and arrangements to stay over if
needed.
• Work with housekeeping to set up
space for overnight arrangements.
• Identify available space that could be
utilised (eg athletic club, outpatient and
ancillary areas that could be closed and
deployed for inpatient needs if necessary).
• Develop plan for food services to
accommodate staff staying overnight
and working extra shifts.
Hospital operations
The business continuity strategy for clinical operations identifies how the hospital
will identify and conduct essential operations during periods of severe staff reduction. The plan for devolution of essential
functions includes the identification of
mission-critical systems; capabilities to
perform essential functions given specific
losses of staff and expertise; reliable logistical support, services and infrastructure
alternatives; consideration of health, safety
and emotional wellbeing of personnel;
communications between staff, and related
computer/software issues.
Essential functions may include:
• Administrative
— accounting (payroll).
• Clinical operations
— anaesthesiology/operative services;
— behavioural health services;
— emergency department;
Page 58
— intensive care unit;
— medical/surgical inpatient units;
— obstetrics services;
— pathology/morgue staff;
— paediatric services.
• Clinical support services
— spiritual services;
— registration/patient access;
— infection control.
Operational objectives of the business
continuity strategy include:
• identification of critical operation
points, functions or processes necessary
for continuity of operations (eg management staff; specific levels of expertise, training or experience; recording or
documentation requirements; health
and safety concerns), which may be
necessary for business to continue and
for staff to provide patient care services;
• plan for service reduction based on
need, critical nature of function as a
support for organisation or local population and other factors;
• evaluation of potential health and safety
issues that might arise through diversion
of staff to new job roles and loss of critical staff in various operational positions;
• liability assessment by general counsel;
• identification of contractors or other
staff options that may alleviate problems
resulting from staff loss;
• identification of work options available
through telecommuting or other offsite
possibilities;
• assessment of flexible leave options that
would allow employees to address
family needs while continuing to support the employing organisation
through a flexible work plan where feasible;
• written notification to employees
regarding employed business continuity
strategies for the duration of the event
Devlen:JCH page.qxd 04/12/2009 12:22 Page 59
Devlen
hospital functions, to the detriment of
the legal or financial rights or entitlements of the organisation or of the
affected individuals. Examples of this
category of vital records are:
— accounts receivable;
— contracting and acquisition files;
— official personnel files;
— payroll records;
— insurance records;
— property management and inventory
records.
and compensation provisions, if feasible;
• assessment of union issues surrounding
overtime
issues
and
disaster
support/sharing of responsibilities
among workers;
• training of workers on an annual basis
with regard to business continuity planning and the need for personal backup
plans for transportation, family needs,
etc.
Vital records and databases
Personnel will be deployed during an
emergency to ensure the protection and
ready availability of electronic and hardcopy documents, references, records and
information systems needed to support
essential functions under the full spectrum
of emergencies. Hospital personnel must
be identified before an emergency in
order to have full access to records and systems to conduct their essential functions.
Essential records may include:
• Emergency operating records: Vital records,
regardless of media, essential to the continued functioning or reconstitution of
a hospital/organisation during and after
an emergency. Included are emergency
plans and directives; orders of succession; delegations of authority; staffing
assignments; and related records of a
policy or procedural nature that provide
staff with the guidance and information
resources necessary for conducting
operations during an emergency, and
for resuming formal operations at its
conclusion.
• Legal and financial records: Vital records,
regardless of media, critical to carrying
out an organisation’s essential legal and
financial functions and activities, and
protecting the legal and financial rights
of individuals directly affected by its
activities. Included are records having
such value that their loss would significantly impair the conduct of essential
Each operational area will account for
identification and protection of vital
records, systems and data management
software and equipment, to include classified or sensitive data as applicable, necessary to perform essential functions and
activities, and to reconstitute normal operations after the emergency.
Communications
Communications systems including cell
phones, e-mail, pagers and similar mechanisms should be evaluated for interoperability and flexible exchange of use across
the hospital where feasible. Cell phone
numbers, e-mail addresses and other information should be readily available to all
staff that may be redeployed, and contact
information outside the hospital necessary
to core operations also made available
where feasible for internal use and continuity of operations. Communication is
one of the most critical components of a
hospital’s disaster response capabilities. In
this regard, the command centre, communication centre and information systems
must work together to maximise the effectiveness of the following communication
systems:
•
•
•
•
telephone system;
Nextel phone;
two-way radios;
VHF radios for centralised emergency
Page 59
Devlen:JCH page.qxd 04/12/2009 12:22 Page 60
How to build a BCP for a healthcare organisation
•
•
•
•
•
•
medical dispatch (C-MED) communication;
computerised communication (e-mail);
cellular phones;
pay telephones (non-PBX);
fax machines (Centrix lines — nonPBX);
intercom systems;
pagers/beepers.
Important considerations for different
functions
• IT
— medical records;
— accessing data;
— editing records;
— electronic authentication of records;
— transcription services.
• Laboratory systems
— ordering tests;
— reviewing results.
• Radiology systems
— picture archiving and communication systems (PACS);
— radiology;
— ordering tests;
— reviewing results.
• Medication management
— ordering medications;
— viewing patient medication profiles;
— medication dispensing;
— medication reconciliation.
• Patient management
— registration;
— patient tracking and location;
— bed management;
— patient information.
• Scheduling of resources
— operating theatre;
— radiology;
— clinic;
— interpreter services;
— laboratory services;
— pharmacy;
— radiology;
— respiratory.
• Logistics/support services
Page 60
•
•
•
•
— employee health services;
— food services;
— laundry;
— maintenance;
— materials distribution — shipping
and receiving;
— purchasing and material management;
— security;
— information systems;
— telecommunications.
Processing claims for reimbursement
— diagnosis and procedure coding;
— charge capture;
— electronic claim submission systems;
— automated billing applications.
Patient clinical monitoring systems
— telemetry;
— remote monitoring systems;
— computer physician order entry.
Non-patient related systems
— human resources;
— supply-chain management;
— food service application;
— environmental care applications;
— medical staff credentialing;
— clinical staff competency tracking.
Enterprise-wide communications
— intranet and extranet sites;
— paging systems;
— network storage and archiving;
— mail services;
— internet access;
— clinical databases;
— scheduling.
REFERENCES
(1) Institute for Southern Studies (2009)
‘University of Texas settles lawsuit over
post-Ike layoffs’, Facing South (online
magazine for the Institute of Southern
Studies), available at:
http://www.southernstudies.org/2009/0
4/university-of-texas-settles-lawsuitover-post-ike-layoffs.html
(2) American Medical Association and
American Public Health Association
Devlen:JCH page.qxd 04/12/2009 12:22 Page 61
Devlen
(3)
(4)
(5)
(6)
(7)
(8)
(2007) ‘Improving health system
preparedness for terrorism and mass
casualty events: Recommendations for
action’, available at: http://www.amaassn.org/ama1/pub/upload/mm/415/fin
al_summit_report.pdf (accessed 1st
December, 2007).
Ibid., p. 1.
See: http://www.flu.gov/professional/
pdf/cikrpandemicinfluenzaguide.pdf and
http://www.flu.gov/professional/
hospital/homehealthcare.pdf (accessed
1st October, 2009).
Davey, J., Devlen, A. and Skinner, R.
(2008) ‘Are We Ready? The BCPWHO
Survey on Disaster Preparedness of US
Healthcare Facilities’, presentation at the
National Emergency Management
Summit, 3rd–5th February, Washington,
DC, available at:
http://www.bcpwho.org/presentations/
100a.htm (accessed 23rd October, 2009).
McCaig, L. F., Burt, C. W. (2005)
‘National Hospital Ambulatory Medical
Care Survey: 2003 Emergency
Department Summary’, Advance data from
vital and health statistics, No. 358. p. 2,
National Center for Health Statistics,
Hyattsville, Maryland.
Ibid.
Devlen, A. (2005) ‘Dana-Farber Cancer
Institute and BCP: The Cure for
Disruption’, Continuity Insights,
(9)
(10)
(11)
(12)
(13)
(14)
May/June, available at:
http://www.continuityinsights.com/
Magazine/Issue_Archives/2005/0506/dana.html (accessed 23rd October,
2009).
Joint Commission (2007)
‘Comprehensive Accreditation Manual
for Hospitals: The Official Handbook’,
(EC.4.11-EC.4.20), The Joint
Commission.
Davey et al, ref. 5 above.
BC Management (2009) ‘International
Business Continuity Program
Management Benchmarking Report: An
Executive Summary, BC Management,
Huntington Beach, CA, July, available at:
http://www.bcmanagement.com/
research/files/BCMIntlProgramMgmt
BenchmarkingReportSummary.pdf
(accessed 1st October, 2009).
Rojas, B. (2008) ‘Children's Hospital of
Philadelphia: BCP Lives Here Issue’,
Continuity Insights, January/February,
available at: http://www.continuity
insights.com/Magazine/Issue_Archives/
2008/01-02/chop_bcp.html (accessed
1st October, 2009).
Davey et al, ref. 5 above.
Bush, G. (2007) ‘Homeland Security
Presidential Directive-21’, The White
House, available at: http://www.fas.org/
irp/offdocs/nspd/hspd-21.htm (accessed
1st October, 2009).
Page 61