Last year I was asked to develop a comprehensive IS based DR Plan for a major teaching healthcare provider. I started out by conducting a Business Impact Analysis to demonstrate to the institution what impact a disaster would have to the care giving ability, finances and community support. It didn’t take long to realize that asking the typical BIA questions would not ascertain the true impact a disaster would have on these hospitals.
arge teaching institutions are inundated with all types of surveys concerning grants, research initiatives, pharmaceutical development, etc. When I introduced this project during a BIA Kickoff meeting to the healthcare community and announced that a “survey” was coming their way, the looks on their faces turned ashen and the murmur echoed “not another survey.” I realized that I had to “sell” them on the idea of filling out this survey and one way to do this was to force the realization that we were attempting to help their departments and clinical practices by protecting their data and, ultimately, their patients’ lives. Patient care is the utmost concern to the providers and aren’t we glad that it is?
If you are initiating a BIA for a health system or hospital that you are not familiar with, I strongly recommend that you obtain assistance from a reliable representative within the institution to introduce and show you the territory. Each institution has their own nuances and the sooner you learn those qualities, the smoother your project will run. You will save a great deal of time. Many hospitals are set on campuses with numerous buildings and many of the same departments are divided amongst different buildings. You will also benefit from the guidance they can provide in developing the survey questions, keeping you from making any improper assumptions. Healthcare institutions are very complex in nature and asking defined questions as to how their departments run will give you better perspective when presenting the findings.
Generally, in conducting a BIA, one of the major objectives is to find out what the financial impact of a disaster would be to the institution. In a clinical environment, this becomes a little more complicated. In a large healthcare institution, clinical departments may not know how much income they actually generate. Insurance payments and government regulations muddy the waters even more. The clinical practices are very familiar with their budgets and the costs of their required resources, but routinely have a difficult time quantifying how the absence of their computer systems would affect their bottom line. A survey of the financial department reveals they may have the numbers, but not be able to accurately portray the impact an IS disaster would have on the ability to render patient care. If you concentrate on securing the qualitative data from the clinical departments and quantitative data from the financial departments, a great deal of confusion can be eliminated.
Patient management is the key phrase to understand. In most cases, a patient is rendered care by a great deal of departments during a typical hospital stay, such as laboratory, nursing, radiology, food service, housekeeping, etc. In-flow and out-flow questions are extremely important to calculating impact. For example, when scheduling an interview with a food service department, I was advised that they are not very important because they didn’t generate income and therefore didn’t feel they needed to participate in the analysis. Even though Food Service doesn’t directly charge for in-patient meals, by law, a hospital will not remain open very long if they cannot feed their in-patients. They are extremely reliant on their computer systems to compile the patient’s food requirements for each meal. Their inflow comes from in-patient departments via the network and their computer applications, and their outflow is the food that sustains lives and allows the hospital to remain open.
Conducting detailed interviews is crucial after you have reviewed the completed surveys from every department. But be warned -- have your questions ready and be prepared. As soon as a clinician feels you are wasting their time and the questions are not relevant to them, you will immediately be shut down and the interview concluded. Most clinicians will work regardless of whether or not the computer systems are functioning. One out-patient surgical department explained during an interview, that if they suddenly lost their critical applications and computers, they (1) would not know who was coming in that day for an appointment, (2) would not have their charts ready when they got there, and (3) probably would not be able to bill them effectively, but they would still feel compelled to provide their patients with the best care possible anyway. While you will surely agree that this is admirable, exactly how would you gauge the impact of a loss of the computer systems?
Well, here are a few questions that helped me squeeze the information required for my analysis from them:
1. If your department renders patient care, how many patients does your department treat per day?
2. What is the average amount per patient that your department bills for these services? (This might be difficult to ascertain, but is possible. Be aware of duplicates, such as Admissions - doesn’t actually produce revenue vs. Surgery - who directly derives revenue.)
3. Could you continue to render patient care without your computers or applications? How long could you provide consistent level of care without these applications - (This will provide you with the Recovery Time Objective “RTO”)?
4. What is your monthly (or yearly) budget? (This will help you break down daily impact plus impress upon them what is really at stake.)
5. If you had to switch to manual mode, would you be able to secure additional personnel with the proper expertise on an emergency basis? Estimate the cost of such personnel or overtime for existing personnel.
6. What applications are you most reliant upon and who controls those applications? (Get them to explain which applications are “frills” and which are “mandatory” in continuing patient care. You will be surprised by the answers. This will define your critical business processes.)
After extrapolating this customized information from your participants, you can add the typical BIA questions to your survey. Don’t just assume that all departments are 24 x 7. Many supporting departments are only open for business between 7 a.m. to 7 p.m. or other hours.
As in any BCP/DR project, senior administrative support is essential. Make the survey participants aware at the onset that senior management wants their department to participate in this project. A signed statement of support from the CEO will get you farther faster.
If time does not permit you to survey all the departments that make up a health system (there could potentially be more than 100 separate departments), divide the departments in three categories: Clinical (renders patient care), supportive (to the clinical departments), and corporate. In doing this, you can make sure that you are getting equal amounts of responses from the three categories, keeping your data more accurate. If you have the benefit of using a survey software product as I did, the data collection process far more accurate and efficient.
After you have compiled all of your data and are ready to present your report to senior management, it is important to remember who your audience is. You are working with health care providers and to them, patient care is paramount. If you speak only in technical terms and financial impact, you could easily lose their attention and further plans for development could be refused. Take the time to explain what a hot site is and how it is used; they will greatly appreciate it. You have to cross the business barrier, speak in their language and to their emotions. Mention the amount of hours it would take before patient care is inhibited, how many hours before public confidence would be jeopardized and when staff productivity would begin to slip. A simple example is the Admissions department. When a hospital admits a patient, insurance carriers need detailed information for pre-certification purposes within a 24-hour window. If your computer systems are down for one week, you might be able to admit patients and render care, but run the risk of not getting paid for your services. When you put it into those terms, you are far more likely to get buy-in from administration.
The BIA was a great learning process for the entire healthcare community. Since most of the departments are focused primarily on patient care, they never took time to think about how they would function without their computer systems and applications being unavailable for a long period of time. Many participants noted that they would give more attention to better work-around procedures, in-flow and out-flow procedures and necessary back-up procedures (which all tie into the new HIPAA regulations). Your training and awareness has now begun and your Disaster Recovery project is on its way. Hopefully, if guided appropriately, healthcare professionals will embrace the importance of disaster recovery incorporating BCP into their healthcare mission in the future.
Kathy Lee Patterson, ABCP, is a Healthcare Disaster Recovery Specialist for the Healthcare Solutions division of Affiliated Computer Services. ACS offers innovative and effective outsourcing solutions for clients worldwide To learn more about ACS, visit www.acs-inc.com.
