Risk Management Manual for Physician Office Practices

  • 729 views
Uploaded on

 

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
729
On Slideshare
0
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
5
Comments
0
Likes
0

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. 3 Focus on Operations and Facility Management: 3.9 Business Continuity Contents Documents You Can Use ....................................................................................................................ii Introduction......................................................................................................................................... 1 3.9.1 Business Continuity Plan ........................................................................................................ 2 Determine What Is Critical ......................................................................................................................... 2 Determine Alternatives for Continued Operations ............................................................................ 3 BCP Responsibilities ...................................................................................................................................... 3 Additional BCP Content .............................................................................................................................. 4 3.9.2 IT Recovery Plan....................................................................................................................... 5 3.9.3 Influenza Pandemic Preparedness Plan .............................................................................. 7 i 2007 IPFCF Risk Management Manual TOC     
  • 2. 3 Focus on Operations and Facility Management 3.9 Business Continuity Documents You Can Use The following documents may be helpful in developing and implementing a Business Continuity Plan: Attachment A: Crisis Management Team Roster Attachment B: Initial Communication to Patients Attachment C: Initial Communication to Staff Attachment D: Employee Call Tree ii 2007 IPFCF Risk Management Manual TOC       
  • 3. 3 Focus on Operations and Facility Management 3.9 Business Continuity Introduction Effective planning for business continuity requires that a For most businesses, survival is the primary purpose of physician practice anticipate what its immediate, interim, and a well-thought-out business continuity plan. For healthcare long-range response would be to unexpected adverse events. organizations there are two additional equally important An emergency response plan, which outlines a plan of action reasons—continuity of patient care and, should a large-scale for immediate response to various emergencies, is activated disaster occur, “the prepared medical office [can] be an asset to first. Required of most employers by the Occupational Safety the community in need and not just another casualty.”2 and Health Administration (OSHA), the goal of emergency response is to prevent the loss of life and to minimize injury and property damage. This type of plan has been discussed separately in Section 3.7, “Emergency Planning”. In this section of the manual, the focus is on planning for actions that may be required after an emergency has been dealt with (i.e., there is no longer an immediate threat to life or property, but there is a threat to the survival of the business because, for example, the office has been destroyed, medical records cannot be accessed, or staff are unable to make it to the office). Three types of plans are discussed:  Sub-section 3.9., “Business Continuity Plan,” outlines actions that are necessary to enable the practice to continue operations if an adverse event impacts critical aspects of the business.  Sub-section 3.9.2, “IT Recovery Plan,” specifically focuses on the threats to vital Information Technology (IT) systems such as electronic medical records, tape back-ups, and storage. This type of plan is also referred to as a disaster recovery plan.  Sub-section 3.9.3, “Influenza Pandemic Preparedness Plan,” addresses the specific risk of, and response to, a pandemic. 2 Klinzing, G and McClure, C, “Could Your Office Cope with Disaster?” Family  See www.osha.gov/SLTC/etools/evacuation/need.html for explanation of what Practice Management, September 999, Vol. 6, No. 8, pp. 26–30. (www.aafp. entities must have an emergency action plan in place. org/fpm/990900fm/26.html)  2007 IPFCF Risk Management Manual TOC       
  • 4. 3 Focus on Operations and Facility Management 3.9 Business Continuity 3.9. Business Continuity Plan A business continuity plan (BCP) for a particular at the most basic level, minimum staff, a place to see practice should address the threats specific to that practice patients, specific equipment, and access to patient records and provide practical strategies for business survival are critical to the continuing operation of most physician and resumption. To continue operations in the face of practices. destruction of a facility, for example, one practice may need For each critical asset, a practice can begin to develop only staff and patient contact information, retrieval details a BCP by asking “What is a disaster?” Using a practice’s for backed-up patient records, and the name and location staff as an example, specific questions might include the of an alternate practice to which to refer patients. Under following: the same circumstances another practice may plan to refer  Is there a specialty service provided by only one of the patients requiring specialized care to another practice physicians in a group practice? while continuing to handle routine appointments at an  Are there administrative tasks that have not been alternate work site. Its plan would include details regarding documented and that are currently performed by only set-up of the alternate work site, alternate practice contact one staff member (e.g., patient billing)? information, and resources for temporary computers,  Does ancillary staff provide a critical service (e.g., a medical equipment and supplies, and answering service. therapist who makes splints in a hand surgeon’s office)? What really drives the form and content of a plan are the functions the practice needs to recover and how soon they The next step is to determine the maximum impairment must be available.3 the practice can withstand and survive. Ask “When do the impacts begin?” and “How much loss can be tolerated?” Specific examples include: Determine What Is Critical  Can the practice survive if a critical person is partially available (e.g., part-time or for limited activities)? Business continuity planning begins with identifying  If yes, what is the minimum acceptable level (e.g., two what aspects of a practice are critical to its survival. Staff, days per week)? equipment, facilities, records, and any other assets and the  How long can the practice survive if a critical person is processes they support should be considered. For example, totally unavailable? 3 General planning questions asked in this section are from Herriott, Larry, CDRP, “Business Contingency Planning Is…,” Disaster Recovery Journal (www.drj. com/new2dr/w3_006.htm); drj.com is a good resource for sample plans and educational materials on business continuity planning. 2 2007 IPFCF Risk Management Manual TOC       
  • 5. 3 Focus on Operations and Facility Management 3.9 Business Continuity Determine Alternatives for Continued is not immediately ready but can be set-up to take over Operations operations (“cold site”);  back-up and/or protection of vital records—to allow the The final step in developing a plan is to determine how the practice to continue to function and to protect its rights practice will survive if an adverse event has a negative impact and interests (e.g., patient records, financial documents, on a critical process or asset. The following questions need to insurance policies); and be answered:  protection, dispersion and/or redundancy of resources,  How can the practice reestablish its business function(s)? facilities, and personnel—to ensure continued operations  What are the options? during disaster conditions.  What will implementation of a recovery plan cost?  How much is enough? BCP Responsibilities Continuing with the example of staff, alternatives might include setting up a mutual back-up arrangement with Practice partners and senior managers should form a another specialist in the area, reducing office hours to reduce crisis management team, responsible for declaring a disaster, expenses, documenting procedures so that they can be done activating the plan, and directing and managing the office by another staff member, contracting with a temporary agency, recovery operations, including: or sending patients to the local hospital for a service that the  setting priorities and objectives; practice temporarily cannot provide.  overseeing, directing, and managing all team members and Other alternatives that businesses commonly consider in the entire recovery process in all alternate locations; developing a BCP include:  directing, controlling and ordering resources, and  succession and delegation of emergency authorities— maintaining a manageable span of control; to ensure effective leadership and enable continued  approving expenses; operations;  resolving conflict and making and implementing strategic  primary and alternate emergency operations centers— and policy decisions; and to enable designated personnel to continue to direct and  designating a spokesperson for any media inquiries. control operations;  alternate operating or back-up facilities—to allow regular A designated business continuity coordinator (BCC) services to resume quickly after an emergency—could be should be responsible for managing the BCP, coordinating a completely redundant worksite that can immediately training exercises, and reviewing and updating the plan take over operations if disaster renders the current facility on a biannual basis. The names, phone numbers, and unusable (known as a “hot site”) or a secondary site that responsibilities of the BCC and the crisis management team should be listed in the BCP manual (See Attachment A, 4 NFPA 600 Standard on Disaster/Emergency Management and Business Continuity Programs, Annex A, “Explanatory Material” (www.nfpa.org/assets/files/ “Crisis Management Team Roster”). pdf/nfpa600.pdf) 3 2007 IPFCF Risk Management Manual TOC       
  • 6. 3 Focus on Operations and Facility Management 3.9 Business Continuity Additional BCP Content Financing is a key component of business continuity. The anticipated cost of business continuity options is one consideration in selecting the best alternative. Finance issues that could result in failure of the plan must also be addressed. This includes clear levels of authority for approving expenses, ensuring continued payroll, and a system for tracking and documenting costs. Though specifically addressed to the hospital CFO, the “Chief Financial Officer’s Checklist for Disaster Recovery,” available through the Healthcare Financial Management Association (HFMA), is a good starting place for business continuity planning relative to finances (www. hfma.org/library/management/). A list of key contacts should be included in the BCP manual or be easily retrievable. For a physician practice this may include patients with appointments within the next few weeks, employees, the property and/or facility manager, local media contacts, suppliers, hospitals or other organizations that frequently refer patients, insurers, and lawyers. Prompt communication to patients and employees is usually essential. See Attachment B, “Initial Communication to Patients,” and Attachment C, “Initial Communication to Staff ” for sample scripts. Attachment D, “Employee Call Tree,” is a form that can be used to set up a system for quickly and efficiently contacting employees.  2007 IPFCF Risk Management Manual TOC       
  • 7. 3 Focus on Operations and Facility Management 3.9 Business Continuity 3.9.2 IT Recovery Plan Because of the wide range of adverse events that can record retention and destruction. Section 3. also discusses disrupt IT and the increasing dependence on IT for The HIPPA Security Rule, which establishes security everything from daily activities to sophisticated data requirements to protect patients’ privacy relative to electronic management, it is important to give this area independent healthcare information. Among other requirements, and careful consideration by creating an IT recovery plan. businesses must develop a disaster recovery plan. Consider All aspects of IT should be considered. This includes the following: hardware, software, specific user operations, patient records, other data files, and general communications. Redundancy of all technologies involved in For the typical physician practice the key concerns to securing, accounting, transporting, authenticating address are back-up systems for computer files (at least two and authorizing access to patient record data is vital back-ups are advised) and equipment and the need to protect to ensuring against practices and procedures that the privacy of healthcare records. Tape back-up systems might be construed as HIPAA violations or threats should be sufficient for most physician practices. Typically to patient well-being. This is particularly notable in a daily copy of all changed data and a weekly full copy of all data storage technologies, where it is critical to store data are recommended. The most recent tapes may be left in multiple, redundant, synchronized copies of the the office, but all others should be removed and stored off- electronic patient record, including all radiological site. The practice should also ensure a back-up system for imagery in all modalities, to prevent a HIPAA-related files left on desktop and laptop computers. Individual users compliance issue from being raised.6 may be required to do this by policy, or the system can be set up to automatically back up the files on the local drive to a Helpful online resources include the following: file server.  The online Disaster Recovery Journal (www.drj.com/) Legal requirements for record retention should be applied provides a number of educational resources and other consistently to back-up tapes and paper records. Refer to tools on disaster recovery planning; on the main page, see Section 3., “Medical Records,” for more information on the links under “Tools”. This site also provides healthcare specific links at www.drj.com/special/industry/.  Business continuity and information technology (IT) experts often refer to an “IT  The Agency for Healthcare Research and Quality, National recovery plan” as a “disaster recovery plan.” At the same time, “disaster recovery” is commonly used to mean recovery from a “disaster” (such as fire, hurricane, Resource Center for Health Information Technology chemical leak) encompassing the broad range of issues related to immediate emergency response, crisis management, and business continuity. It is not always immediately evident how “disaster recovery” is being used by a particular resource, and it may be necessary to briefly scan the resource to confirm the intended 6 Peglar, R, “Beefing up your Storage Networks: A Solution for Disaster Recovery,” meaning and avoid confusion when researching this topic. Radiology Management, 2003, Jan–Feb;2():8–2.  2007 IPFCF Risk Management Manual TOC       
  • 8. 3 Focus on Operations and Facility Management 3.9 Business Continuity (www.healthit.ahrq.gov), provides links to resources on disaster recovery (search “disaster recovery”).  The Contingency Planning Guide for Information Technology Systems, developed by the National Institute of Standards and Technology, is a very in-depth guide for government IT contingency planning (www.csrc.nist.gov/publications/ nistpubs/800-3/sp800-3.pdf ). Larger practices with more complex systems may find this a helpful resource.  2007 IPFCF Risk Management Manual TOC       
  • 9. 3 Focus on Operations and Facility Management 3.9 Business Continuity 3.9.3 Influenza Pandemic Preparedness Plan An influenza pandemic is a unique type of crisis, requiring special planning. Unlike the local or regional events that a typical business continuity plan addresses, a pandemic is a global event with prolonged consequences. Because of the recent spread of a new virulent strain of a flu virus among birds, with as yet limited bird to human transmission, pandemic response planning is occurring at every level of government. Businesses are being encouraged to prepare their own response plans. A pandemic will have a direct impact on a practice’s staff, patients, and suppliers, as well as an indirect impact by limiting access to public transportation, restrictions on public gatherings, and interruptions to the availability of food supplies and consumer goods. The U.S. Department of Health and Human Services (HHS) has established the Web site www.pandemicflu. gov, which includes information to better understand and prepare for a pandemic. It also includes links for state-specific information (Wisconsin information can be found at www. pandemicflu.gov/plan/states/wisconsin.html). While a pandemic disrupts a practice’s business, it also increases the demand for healthcare services. HHS and the Centers for Disease Control and Prevention (CDC) provide the “Medical Offices and Clinics Pandemic Influenza Planning Checklist” that takes this dual impact into account (www. pandemicflu.gov/plan/medical.html). The checklist includes links for further information that a practice can use to customize its influenza pandemic preparedness plan. 7 2007 IPFCF Risk Management Manual TOC     