In traditional emergency management terms, the phases of disaster management often are expressed as mitigation, preparedness, response and recovery. The response and recovery phases traditionally focus on actions taken to save lives and property during an emergency, and actions taken to return to normal or near-normal conditions, respectively.
With the advancement of technology even more deeply ingrained in the delivery of health-care services, health-care organizations are expanding their focus from disaster management to a broader focus on disruption management — meaning the disruption of critical clinical and administrative functions and services caused by an interruption of one or more of their critical dependencies.
“At the heart of our mission is research-driven patient care for our cancer patients,” said Terry Cooper, director of business continuity planning for the University of Texas MD Anderson Cancer Center. “We cannot afford to interrupt important patient-care protocols, which in some cases can be the patient’s last hope.”
More health-care institutions across the country are investing the resources required to design, launch and sustain an integrated continuity of operations program. Jim Paturas, director of emergency preparedness at the Yale New Haven Health System (YNHHS) in Connecticut, has overseen the system’s program and placed significant emphasis on departmental recovery. “We realized that while hospitals have historically done a good job preparing for responding to a community-based disaster event, we had not done a good job preparing for the eventuality that we could be the site of the disaster and would need to recover as quickly and efficiently as possible.”
The Business Case
For many health-care organizations, these are essential questions that remain unanswered or at least unarticulated. To implement an integrated continuity of operations program that places responsibility in the hands of each clinical and business manager requires a significant time investment in process infrastructure.
“When we engaged our executives in this discussion, it really helped when we put it in terms of the effort it would take to start and sustain an enterprisewide budgeting process if none existed,” said Linda Reissman, emergency manager at the Memorial Sloan-Kettering Cancer Center in New York City. “We summarized it in the following way: Organize an expert central team, provide basic training and develop a toolkit to help every manager develop his or her first budget,” Reissman said. “Once the first budget is developed, it is easy to maintain if:
- Senior management communicates the importance of this initiative and addresses managers who are slow to participate.
- Manager’s variable compensation is tied to successful participation in the program.
- We develop policy, procedure and a permanent governance function to support the ongoing budget process and train staff for continuous improvement.”
Factors for Success
At MD Anderson, Cooper has had significant success engaging management and implementing a sustainable program.
“A number of factors have contributed to our success, but two factors stand above the rest,” Cooper said.
First, MD Anderson assembled a Business Continuity Planning Executive Steering Committee as a multidisciplinary committee representing all of the institution’s mission areas. The committee helped drive the business continuity program across the institution. “Second, we developed two versions to our business continuity plan,” Cooper said. “One version [full plan] is the classic business continuity plan, driven off the results of the business impact analysis and development of contingency procedures.”
Cooper said the full plan is used in mission-critical areas. “The other business continuity plan is called a ‘bridge plan’ and is primarily a contingency plan for daily operations,” he added. “The bridge plan is used primarily in administrative support areas. With this dual-choice approach, we gained significant respect and credibility with our management team, showing our sensitivity to their needs and time availability.”
At YNHHS, Paturas and his team saw executive support grow as they demonstrated tangible results from a pilot deployment. “Many of the processes needed for departmental recovery were already in place but never written down,” Paturas said. “In addition, most departments never realized the ‘downstream’ effect the loss of their service had on another area or department. This emphasized the need to have departmental plans in place that were coordinated with other departments.”
Emergency Manager’s Role
For many emergency managers, their role and responsibilities are already fully consuming and the thought of getting involved in supporting additional planning is nearly inconceivable for a variety of reasons, including limited financial and staff resources, executive disinterest and competing initiatives.
“I got involved from the beginning,” Reissman said. “There was no one else to lead this effort. And I knew this was the direction we needed to go as an institution to make sure critical patient services were always there when needed. As a result of the early successes, I have been able to hire a full-time staff person to now oversee and grow our recently launched departmental recovery planning program.”
MD Anderson now has defined processes and procedures to handle operational or business disruptions beyond the information in emergency operations plans, Cooper said. In addition, his business continuity team works closely with MD Anderson’s separate emergency management department. They share common practices and use the same automated planning tool — as does their IT disaster recovery team.
Whether tasked to lead, follow or support the initiative, the way ahead seems clear. Health-care institutions, regulators and other stakeholder communities are embracing departmental recovery planning for various reasons.
“Business continuity is essential in every institution,” Cooper said. “Many times, the institution is unaware that it could be one incident away from an event that could close its doors permanently.”
At YNHHS, Paturas has seen similar growth in the interest and support for departmental recovery planning. “It has allowed us to develop and test plans that help ensure that we have response and recovery plans in place to remain resilient and serve the community.”
The Business Continuity Maturity Model
A health-care-centric definition of “integrated continuity of operations” based on the Business Continuity Maturity Model, Virtual Corp.’s globally recognized standard for integrated business continuity program assessment, is as follows:
• Incident Management: Advanced planning and preparations that ensure health and safety, limit environmental impacts and protect company assets. This includes emergency response, crisis management and emergency operations.
• Technology Recovery: Advanced planning and preparations that ensure the ability to recover and restore critical assets, including IT delivery systems, voice and data networks, and business applications within defined recovery time objectives.
• Clinical and Business Recovery: Advanced planning and preparations that ensure continuity of critical clinical and business functions in the event of a disruption or emergency. This includes the identification of impacts to the clinical and business environments, implementation of viable risk mitigation and recovery strategies, and the development of clinical and business recovery plans.
• Security Management: Physical security, cyber-security, information security and any other activities associated with protecting targeted information, personnel and resources.
Business Continuity Challenges
Launching and sustaining a business continuity function requires implementation of a sustainable business process. To select the right individuals to serve as members of a central business continuity function, you need to understand the challenges to be faced throughout implementation.
The following is a summary of the more significant challenges that can be expected while designing and launching a sustainable business continuity program:
• Understanding: Ensure that executives understand key business continuity concepts and principles. This helps in setting the scope and realistic expectations for the business continuity program.
• Cooperation and Commitment: Not everyone willingly cooperates in committing personnel, time and other resources into the business continuity program.
• Accountability: The success of the business continuity program should be tied to local management’s performance reviews and variable compensation, if possible.
• Importance and Priority: Local management must continuously stress the seriousness and importance of the business continuity program to the personnel involved.
• Timing: Be sensitive to other priority initiatives already under way or that may be implemented in the same time frame.
• Interference: Executives who haven’t bought into executing the business continuity program may create interference in the program command chain.
• Staffing: Either staff to meet the business continuity program plan or plan the work within the business continuity staffing limitations. If you can only support building one new business continuity plan per year, focus on critical, high-visibility clinical services.
• Communication: Communicate business continuity program status and issues frequently and in different modalities. Never assume that everyone is reading your e-mail. Create a business continuity website, newsletter and other creative means of getting the message out.
Scott W. Ream is the president of Virtual Corp., a business continuity consulting and software company.
