DISASTER RECOVERY 
JOURNAL

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276 
Fax: (314) 894-7474
Internet www.drj.com 
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

MANAGING EDITOR
Jon Seals
jon@drj.com

COPY EDITORS
Richard Sandhofer
richards@drj.com
Pamela Clifton
pamelaclifton@hotmail.com

ADVERTISING 
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President 
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

EXECUTIVE COUNCIL
Patrick Corcoran, IBM Bus. Cont. & Rec. Services
Jeff Dato, MBCP, KPMG
Edward S. Devlin, E.S. Devlin & Associates
Judith Eckles, SunGard Availability Services
James Hammill, CBCP, JMH Consulting Inc.
John Jackson, Independant


INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity 
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
www.drms.com.br

Click Here for a Printable Version

HIPAA

Checklist for Dealing with SARS Outbreak

By HENRY EE, MBCI, CBCP

The outbreak of Severe Acute Respiratory Syndrome (SARS), commonly known as Atypical Pneumonia (AP) that spread like wildfire recently, has been posing a big health risk to many people around the world.
By as early as June 2003, statistics showed that more than 8,500 people were already infected with the virus with more than 800 deaths worldwide.
There is no known cure for this illness except fighting it by using one’s own immune system. Companies, especially those with front line staff who need to interact with customers, are more prone to the virus. They have been busy drawing up their contingency plans for the past weeks.
So what is the big fuss all about? A typical contingency plan consists of the combination of technology, manpower, critical document and an alternative site. In a SARS contingency, the primary site may be still available but no manpower as the staff may be quarantined at home. That means the normal contingency strategies cannot be used under these circumstances.
Here are some tips for SARS contingency you could adopt:

1) Meet the expectation of the regulator
Check with your regulators on any guideline with which you need to comply. For example, Hong Kong Monetary Authority (HKMA) is currently requesting its members provide a manpower contingency plan if there is an infected case in the company (www.info.gov.hk/hkma/eng/guide/circu_date/20030402e1.htm). It would be equally important for companies in all industries to stay alert and plan for the unplanned.
Singapore Ministry of Health invoked the Infectious Disease Act on March 24, 2003, to isolate all persons who have close contact with persons diagnosed with SARS. The home quarantine information can be found at http://app.moh.gov.sg/sar/sar08.asp. All persons under home quarantine must not leave the house, not even to see the doctor or go to work. Affected employers which have employees under home quarantine had to follow the wage guidelines provided by the Ministry of Manpower.

2) It is the people, not facilities
Many companies have recovery sites (hot, cold or dedicated) ready. But in a situation like SARS it will affect your staff, not the facility. The facilities will still be there, but what if your staff is infected? You may not need to get your recovery site to standby, unless you plan to split your workforce to a different working area.

3) Communicate, communicate, communicate
Communication is one of the most vital tools in determining the success of any BCP plan.
Although the spread of SARS may reduce the number of face-to-face meetings, communication should not stop here. Try to use other media such as video conferencing, e-mail or merely using the phone to pass the message. Communicating your SARS contingency plan to all staff is equally important. Without an effective communication plan, your BCP plan will not work as well as it is being planned.
Consider the following for a command and control in your SARS contingency:

a) Crisis management team: Consisting mainly of the department heads and the function group like legal, compliance and facilities; this is the decision-making committee that makes major decisions like declaring emergency and activation of SARS contingency or an recovery plan.
b) BCP working group: Consists of the respective department BCP coordinators; this is the working group that determines the SARS contingency needs and keeps all departments informed of the SARS contingency status.
c) Escalation procedure: If a staff member is identified with SARS, what should the immediate superior or manager do? Whom should they escalate the report to? And what immediate action should they or the crisis management team take? Remember: timing is the key issue in this.

4) Let the staff know you care
Provide masks. Although most of the staff may have already brought a mask themselves, it is still heartening to see that management cares. Keep the staff updated on the conditions of their fellow colleagues who may have been isolated for some reason. Have cleaners clean and sterilize the offices daily. Make sure staff are comfortable working in the environment and know that you care and are taking the necessary measures.
If possible, provide staff with access to medical advisors such as a medical hotline or have a nurse or doctor stationed for a few hours per day in the office. In case there is any person who is feeling ill, he or she can go to see the medical staff directly without having to go to the clinic which may pose higher risks. If there is no sick bay, convert one of the smaller meeting rooms as isolation room.

5) Quick Win
The SARS contingency plan is different from any traditional BCP or even Y2K contingency in that you cannot afford to take the next few months or even years to develop a full SARS contingency plan. You need to react as quickly as possible and have some quick-win actions that you can execute almost immediately. For instance, decide what you will do if your business becomes affected by SARS tomorrow. One suggestion is to have some laptops and remote access set up for more people than you usually do. Have managers think about special work assignments that could be done at home while people are in quarantine, but not sick. This will help your staff continue to feel productive, and benefit your company at the same time.

6) Consider the preventive measures (identify and isolate)
Be proactive in identifying staff members with SARS symptoms. With fever as the first symptom in identification of the virus, it may be advisable to have a thermometer in every department and get the staff to check their temperatures once per day. Educate staff not to overreact to rumors and suspected incidents. Maintain high standards of personal and environmental hygiene in the working area. Issue management guidelines on travel; minimize unnecessary travel and keep track of staff traveling to high-risk areas. You may need to isolate the staff that travels to SARS infected areas, regardless of whether it is for personal or business purpose.

7) Preparations for plan invocations
Define different scenarios that could likely affect your operation and work out the action plan such as evacuation, cleaning up process, activation of SARS contingency, return to normal operation.
Pre-define what is the likely outage if one or more staff members are identified with SARS virus. If it happens, should you do an overnight clean up? Or close the office and wait for five days, seven days or 10 days? Consult with medical support and obtain advice before you make this decision. Establish recovery strategies and priorities of business functions in the affected scenarios for all office facilities. Consider what you would do if a cafeteria worker contracted SARS and your entire building was quarantined for 10 days. What if the public health authorities decided to quarantine people in your building (i.e., not allow them to go home)?

8) Be sensitive to the needs of others
In April, about a month after SARS affected Hong Kong and Singapore, lots of companies considered using their recovery sites or overseas offices as the alternate site. You need to be sensitive to your staff and even your vendors’ consideration. While you may be moving your staff to another location as a preventive measure, will the staff at the other location worry that the staff you are moving over pose a high risk to them?

9) Face the world and tell the truth
Plan for the worst and in case it happens, get the press release ready and tell the truth. Don’t cover up. Your customers, shareholders and staff have the right to know what is happening.

10) Our SARS recovery strategy
After multiple brainstorming sessions, our team came up with the following strategies. We trust that by sharing this information, BCP practitioners in the region will benefit.

a) Split workforce. If you have more than one office facility, you can consider splitting the workforce. For example, front office in Zone A and back office in Zone B. Separate the functions and move some of the back office operation staffs to work in Zone A and vice versa. In the worst case, back office operation will still be able to function if Zone B is identified to be infected with the SARS virus and need to be isolated. If you have only one office facility, you may consider moving part of your workforce to the recovery site.
b) Transfer the function or staff overseas. To be honest, we always have this reservation in the last few years when a business manager told me they can transfer my function to another location and resume work as normal. However, it is difficult to test this strategy with so many factors involved (e.g. airfare, border regulations, travel visa, family commitments, etc...). For the SARS contingency, this is a perfect solution. Don’t expect a 100 percent recovery of your work or even an 80 percent at another location. But at least if you start to plan for it now, you can get it to work and your business can still go on. If you consider transferring staff overseas as a preventive measure, you need to check what is the receiving country health policy and also be sensitive to the needs of others.
c) Work from home. With today’s technology, many job functions can be considered for work from home. However, you will need to consider compliance issues like voice recording, human and environmental issues. For example, does the staff member’s home allow him/her to work effectively? Don’t forget that schools are closed; their children might be more keen to get their parents’ attention than allowing them to work.

Remember, a combination of the above strategies is likely for your SARS contingency to work rather than choosing just a single approach.

To comment on this article, go to 1603-08 at www.drj.com/feedback.

©Copyright 2003 Systems Support Inc. All rights reserved. Reproduction in whole or in part in any form or medium without the express written permission of System Support Inc. is prohibited.