A healthcare system developed a business continuity plan using a holistic and phased approach. The plan involved establishing governance, conducting a business impact analysis to identify essential functions, and designing the plan based on hazards identified. The plan defines roles and responsibilities, outlines communications methods, and establishes orders of succession to ensure continuity of operations during disruptions.

1. Building Hospital Resiliency: Utilizing a Holistic
Approach to Respond and Recover from a
Disruption
Emergency Preparedness Conference:
2013 “Is Recovery Ever Really Over?
The Joint Commission
Las Vegas, NV May 1-2, 2013
1

2. Yale New Haven Health System
Westerly YSM
YSM Yale Medical Group
Bridgeport
Bridgeport Greenwich
Greenwich Yale-New Haven
Yale-New Haven Northeast Medical Group (NEMG)
 Largest, most integrated healthcare system in Connecticut with $2.6 billion in revenue
 18,435 employees and 5,675 physicians
 93,923 patient discharges and 1,397,632 outpatient encounters
 2,130 licensed beds
 6 hospitals (including a Level 1 Burn Center and a Level 1 Trauma Center), a children’s
hospital, a psychiatric hospital, a comprehensive cancer hospital, a physician practice
organization and ancillary primary, urgent and emergent care facilities
 Other clinical affiliations include the YNHHS Heart Institute, Pediatric Network, Telestroke
Network and Cancer Network with other area hospitals
 501c3 nonprofit organization
2

3. Objectives
• History of BCP/COOP
• Terminology
• Standards and Compliance
• BCP Challenges & Pitfalls Objectives
• Tips to develop a HVA and BIA
•Identify your essential functions
•Identify the components of a BCP/COOP
•Learn how to test and evaluate your
BCP/COOP
•Discuss review and maintenance of
BCP/COOP
3

4. Overview
• Event
• History of BCP/COOP
• Terminology
•Standards and Compliance
4

5. BCP/COOP Event
modified U.S. DoD graphic
Incident Occurs Return to
Normal Operations Recovery
Time
Objective
Normal Operations
Capability
Recovery
Minimum Acceptable Level
of Capability Emergency Response Restoration
Contingency Planning
Risk Mitigation and Crisis Management
Proactive HCC Time Proactive HCC Activities
Activities
Prevention and Preparedness Prevention and Preparedness
Reactive HCC Activities
Response, Recovery & Restoration
5
Used by courtesy of The Virtual Corporation
5

6. Overview
• BCP/COOP should be an organization or department-
wide initiative utilizing a holistic approach to prepare the
organization to recover after an interruption of its
essential functions and business operations.
• Taking an holistic approach to organizational resilience
will allow hospitals and health systems and the
communities they serve to fully embed business
continuity and continuity of operations into their fabric.
• The process involves assessing, developing, testing,
and maintaining a system-wide business
continuity/continuity of operations plan which addresses
any type of disaster covering key technical, operating,
business and clinical functions.
• In general, the process undertaken will occur in
multiple steps over the course of approximately 18-36
months.
6

7. Business Continuity Plan vs. Continuity of
Operation Plan
• The terms Business Continuity Plan (BCP) and Continuity of
Operations Plan (COOP) are used interchangeably
• According to the Business Continuity Institute, a Business
Continuity Plan (BCP) is a document containing the recovery
timeline methodology, test-validated documentation, procedures,
BCP
and action instructions developed specifically for use in restoring
organization operations in the event of a declared disaster.
• Continuity of Operations Plan (COOP) – Organized processes
that facilitate system restoration for emergencies, disasters,
mobilization, and for maintaining a state of readiness to provide
the necessary level of information processing and business
functions commensurate with the mission requirements and
priorities.
• In either case, the ultimate goal of developing a BCP/COOP is
to provide procedures and capabilities for sustaining essential
organizational business and clinical operations and strategic
functions while recovering from a significant disruption
7 7

8. BCP/COOP Standards & Regulations
The goal of any standard is to follow a clearly structured good
practice guide to how to develop a Continuity Management
System (CMS) and to be able to audit and monitor the COOP
practices of organizations
• National Security Presidential Directive 51/Homeland Security
Presidential Directive 20, National Continuity Policy, May 9,
2007.
• Public Law 109–417, the Pandemic and All-Hazards
Preparedness Act (PAHPA) was passed that included SEC.
2802.
• BS 25999, the British Standard for Business Continuity
Management established by the British Standards Institution.,
is becoming widely accepted around the globe as the de facto
international standard
• Its nearest competitor is the US National Fire Protection
Association’s NFPA 1600 standard Standards on
Disaster/Emergency Management and Business Continuity
Programs
• Joint Commission Hospital Accreditation Program (HAP) 2010,
EM.02.01.01
8

9. BCP/COOP Pitfalls & Challenges
Pitfall # 1 – Not having a plan(s)
• Huge risk to the core business, operational and clinical functions of the
organization
• Potential loss immeasurable and the risk of legal liabilities
Pitfall # 2 – Not maintaining plans
• Require routine maintenance/updating
• Must be dynamic and evolve as threats change
Pitfall # 3 – Not exercising or testing plans
• Contingencies are not part of normal operating procedures
• Exercises must cover several types of contingencies
Pitfall # 4 – Not raising awareness of plans
• Contingencies affect everyone in the organization
• Changes or updates to plans require acquainting staff with new
procedures
9 9

10. BCP/COOP Pitfalls & Challenges
Pitfall # 5 – Not identifying essential functions
• Not everything is mission essential
• Need to identify and prioritize critical assets
Pitfall # 6 – Not identifying key roles and
responsibilities
• Chain of Command/Span of Control are
essential
• Must reflect current staff and their contact
information
Pitfall # 7 – Not coordinating plans with partners
• Many interdependencies exist in a crisis/disaster
• Establishes boundaries, roles and responsibilities
10 10

11. BCP/COOP Pitfalls & Challenges
• One of the challenges that prevents organizations from taking full
advantage of a holistic approach is the presence of organizational silos
• Most organizations, especially larger ones, are actually a
conglomeration of many different divisions, departments, business
units and operations.
• These are often structured as silos and in some cases are self
contained, self managing entities which have minimal interaction and
communication with other parts of the organization.
• Despite this apparent autonomy they normally have strong
dependencies on services provided by other parts of the organization,
such as IT, purchasing, finance, human resources and payroll to name
a few.
• Lack of transparency, uncooperative managers, unwillingness to buy
into the BCP/COOP process and organizational politics are common
aspects of silos.
11 11

12. BCP/COOP Pitfalls & Challenges
• No organization is an island and one of the larger challenges
to holistic BCP/COOP is how to ensure that critical suppliers
are not a single point of failure and are not at risk of
downtime.
• This is especially true when an organization is
outsourcing critical business infrastructure, such as
IT services, to third parties.
• As part of the holistic BCP/COOP process suppliers should
be mapped and critical suppliers should be identified.
• Once identified it is important to determine:
• What contracts have been agreed with these companies
• What BCP/COOP arrangements do suppliers have in place
• Are there alternative suppliers readily available
12 12

13. Phased Approach
1-3 Months 6-9 Months 9-12 Months 12 Months Ongoing
13

14. Phase 1 - Project Initiation
C-Suite
Buy-In
14

15. Phase 1 – Project Initiation
Establish Governance and Obtain Buy-In
•Meet with Senior Leadership
• Obtain commitment from leaders
• Present the goals and objectives
•Establish Planning Team / Steering Committee
• Develop Team Guidance / Governance
• Scope / Assumptions / Mission Statement
•Establish Project Timeline
• Outline project milestones and goals
• Finalize overall project schedule
• Identify project team
15

16. Phase 1 – Project Initiation
BCP/COOP Steering Committee
 Provide hospital or healthcare system-wide business continuity
planning project oversight to support the planning, response,
resumption, recovery and restoration of operations
 The following is a list of individuals from the your healthcare
organization that should comprise key decision makers
representing clinical, administrative, business, technology and
support services
– Senior Executive
– Administration
– Operations
– Legal/Compliance
– Information Systems & Technology
– Human Resources
– Facilites
– Financial Services
– Medical Affairs
– Risk Management
– Patient Care Services
– Emergency Management
16

17. Phase 1 – Project Initiation
BCP Project Support Team
The BCP/COOP Project will be coordinated by the
BCP/COOP Project Team. These members serve as
the BCP/COOP project liaisons and provide day-to-day
support and integration of all BCP/COOP activities. The
following are the BCP/COOP Project Team members.
 Project Manager
 Project Lead
 Point of Contact (POC)
 Project Database Administrator
 IS&T Disaster Recovery
 BCP/COOP Training and Planning Specialist
 Emergency Management Specialist
 Clinical Liaison
 Financial Liaison
 Risk Management
 BCP/COOP Consultants (prn))
17

18. Phase 2 - Business Impact Analysis
BIA
18

19. Phase 2 - Business Impact Analysis
Conduct a Business Impact Analysis
•Determine your Vulnerability / Hazards
• Review Hazard Vulnerability Analysis
(HVA)
• Review Risk Assessments (RA)
• Review Past History of Storms Human
Resources
Surge
Capacity
• Discuss with Emergency Management
Officials and other emergency response
organizations in the community
19

20. Phase 2 - Business Impact Analysis
Determine your Business Impact
Defined by Disaster Recovery
Institute International (DRII) as:
“Identifying the impacts
resulting from business interruptions
that can affect the organization and
techniques that can be used to quantify
and qualify such impacts.”
PROVIDES THE BASIS FOR YOUR
BCP/COOP
20

21. Phase 2 - Business Impact Analysis
Determine your Business Impact
•Gather data via a survey or questionnaire
• Can be distributed to all employees or select management
group who can provide an overview for the entire
organization
• Asks targeted questions about what is critical to the
organization
• Determines impact if the service was not available for a few
days
• Determines any relationships between other departments or
organizations
•Follow Up with specific questions
• For anything that is not clear, conduct a follow up interview
or observe this service to see how it effects the business
• Aim to truly define what are essential functions
• Could be conducted in a group setting
21

22. Phase 2 - Business Impact Analysis
Determine your Business Impact
•Analyze / Review Data
• Identify the main areas of the organization
• Assess the impact of disruptions
• Loss of staff
• Loss of equipment
• Perception by the public
• Regulatory requirements
• Financial
• Environmental
• Relationships (Public and Partners)
• Determine minimum needed resources and staff to carry
out
• Can this service be carried out remotely?
• Determine once interrupted how long will it take to restore services
22

23. Phase 2 - Business Impact Analysis
Identify Time-Sensitive Business Operation Processes and
Application Systems
• Establish a method of grouping clinical, business and
operational processes and technology application systems in
line with their importance to the overall function of the
organization like business time-sensitivity ratings.
• Time-sensitivity ratings are usually expressed in terms of the
minimum and maximum time that the organization can
withstand an interruption of a particular clinical and/or business
operation or technology application system.
• Record each clinical business and operational processes,
functions or technology application systems along with its time-
sensitivity rating.
• A comprehensive BCP/COOP will document a single or
multiple strategy and tasks for every level of business time-
sensitivity.
23

24. Phase 2 - Business Impact Analysis
Hazard Vulnerability Analysis
Kaiser Permanente Model - http://www.nachc.com/EM-Planning.cfm
• Mainly used for healthcare facilities, but can be adapted for public
health use
24

25. Step 2 – Business Impact Analysis
Example of a Business Impact Analysis survey that was completed by functional
managers of departments/work units and ideally use a computer-based data
collection tool
The chart below identifies actual data of survey responses conducted at a
healthcare system based on their title and positions
7%
2%
2%
3%
5% Directors
Managers
Vice Presidents
10% Coordinators
Assistants
CIOs
Other
71%
25 25

26. Step 2 – Business Impact Analysis
Examples of Departmental Responses to a Disruption
86%
90% 84%
77%
80%
70%
70%
Percentage of 60% 57%
Survey 50% 48%
Percentage of
Responses 40%
Survey
Responses 30%
20%
10%
0%
Patient Car e Adver se
Patient Regulator y
Pati ent Conf idence Compli ance Liabil ity Cash Fl ow
Outcome
Type of Impacts
Type of Impacts
26
26

27. Phase 3 – Plan Design and Development
27

28. Phase 3 – Plan Design and Development
Based Upon HVA and BIA
• Plan for the most probable and highest impact
events
• May want to include hazard specific annexes
• i.e. how workforce will be protected from
Pandemic Flu
Defines Roles and Responsibilities
• Who is responsible for what during a BCP/COOP
activation
• May not be the traditional department / personnel
Identifies Triggers for Activation / Devolution
• Who is responsible for activating the BCP/COOP
• What is the trigger for activation (storm warning,
absenteeism rate, etc.)
• Is this a facility specific emergency or disaster?
• When should you return to normal operations?
28

29. Phase 3 – Plan Design and Development
The Concept of Operations describes the procedures for Phase 1
BCP/COOP plan implementation.
Emergency
BCP/COOP plan implementation takes place in four phases:
Phase 2
• Phase I: Readiness and Preparedness
• Phase II: Activation and Relocation (0–12 hours) Phase 3
• Phase III: BCP/COOP Operations (12 hours–30 days or until
Phase 4
resumption of normal operations)
• Phase IV: Reconstitution (recovery, mitigation, and termination)
29

30. Phase 3 – Plan Design and Development
Identifies How Communications with Employees
and Organizations are Carried Out
• Do you have a 24/7 contact list for ALL personnel
and how to notify employees?
• Emergency notification system
• Department cell phone numbers, office
numbers, e-mail
• Home number, personal cell phone, home
email
• Are they capable of receiving texts?
• Agency 24/7 contacts
• Social media uses (websites, Twitter™,
Facebook™)
• Mass notifications systems
• Two-Way Radios
30

31. Phase 3 – Plan Design and Development
Outlines Order of Succession / Delegation of Authority
• Orders of Succession
• In the event a person cannot carry out their duties, outlines who is
responsible for that duty
• Should have a backup and a backup’s backup
• May not be the organization’s traditional organization chart
• Should be outlined by position and duty (i.e. different person will have
different responsibilities for a natural hazard vs. a pandemic flu)
• Ensure 24/7 contact information for all parties
• Performance of unusual or additional duties by staff or reassignment
• Delegation of Authority
• Delegations of authority are formal documents specifying the activities that
may be performed and the legal authority of those authorized to act on
behalf of the agency head or officials
• Delegations of authority ensure rapid response to any emergency situation
requiring BCP/COOP implementation
• Identify the authority being delegates, to whom it is being delegated, limits
of the authority, when authority would terminate
31

32. Phase 3 – Plan Design and Development
Define How Essential Functions Will Be Carried
Out / Concept of Operations
• First essential functions are defined
• What functions must your organization carry
out
• Then essential functions are prioritized
• Defines who is responsible for these functions
• Agency / Department / Person
• Are they aware of their 24/7 responsibility
• Are there any duties that can be suspended
during a BCP/COOP?
• Permitting Processes
• Inspections
32

33. Phase 3 – Plan Design and Development
Alternate Work Locations / Telework
Arrangements
• Do you have an alternate location should your
office become unusable?
• Is it equipped or do you need to bring supplies
with you?
• Can employees telework in the event of an
emergency?
• Do they have the right equipment to telework?
• Who is essential vs. non-essential personnel
• Are there other agreements for use of the
facility by other departments?
• Has a HVA or RA been completed for that
building?
• Does your employees need training to use
this facility or its equipment?
33

34. Phase 3 – Plan Design and Development
Integration with EOP / EMP
•Is your plan NIMS / ICS Compliant
•Can it be integrated with your organization’s
Emergency Operations Plan (EOP) and / or
Emergency Management Plan (EMP)
•Are there any duplicative roles for your personnel or
unrealistic roles or responsibilities
•Do your personnel understand their roles in all
plans?
34

35. Phase 3 – Plan Design and Development
Other Considerations
• Design a consistent departmental/work unit BCP/COOP format and structure used across all
delivery networks that is integrated with the existing emergency management processes:
 Overview  Strategy Support Materials
– Recovery Plan Overview – How All BCP/COOP Plans Fit Together
– Plan Distribution & Storage – Department Planning Assumptions
– General Plan Scope – Directions to Recovery Location
 Recovery Team Task Lists  Forms
– Recovery Team Roles & Assignments – Activity Log
– Delegation of Authority – Move and Relocation Forms
– Department Response Team Procedures – Plan Testing and Maintenance procedures
– Loss of Bldg Access  Reference Materials
– Loss of Key Personnel – Recovery Time Objectives (all depts)
– Loss of IT Applications – Business Impacts (all depts)
– etc. – Dept Business Impact Analysis Findings
– Resumption of normal operations – Business continuity policies
 Call Lists – Physical and security assessments
– Department Call List – Vital records and off-site storage program
– Vendor Call List – Department and corporate succession
– Personnel Notification Procedure plans
 Recovery Resources – Budget considerations for capital and
– Internal / external personnel operating expenses
– Environmental Resources  Links to Emergency Response Procedures
– Fixed and Portable Medical Equipment – Damage impact assessment procedures
– Critical Supplies – Command center activation procedures
35

36. Phase 3 – Plan Design and Development
Other Considerations
• Expand usage of the “Hospital
Incident Command System”
(HICS) to define responsibilities,
clear reporting channels, and a
common nomenclature to help
unify hospital recovery and
restoration activities with other
emergency responders
• Add the position of Business
Continuity Branch Director to
each HICS Incident
Management Team structure
• Reports through the Operations
Section Chief
• Update all HICS Job Action
Sheets (JAS) addressing
“Recovery Role” for ICS
personnel
36 36

37. Phase 4 - Plan Implementation
37

38. Phase 4 – Plan Implementation
Distribution
•Distribute plan to all personnel and outside agencies who
have a role in the BCP/COOP
• Ensure that Emergency Management, Public Health &
Jurisdictional Authorities have a copy
• Maintain a record of distribution for updates and changes
• Ensure Control Procedures
Develop Training
•Being to develop awareness training and exercises with the
following goals in mind
• Ensure that all participants are aware of their roles and
responsibilities
• Ensure all know how the office will function during a
BCP/COOP (Telework, Essential Personnel, etc.)
• Hold a full scale exercise so all can see how plan is activated
and difference for normal working conditions and a
BCP/COOP situation
38

39. Phase 4 – Plan Implementation
Deliver Training
•Deliver Various Types of Training Programs as
appropriate
• Computer-based
• Classroom
• Test-based
• Instructional guides and
templates
•Develop Awareness Programs
• Management
• Team members
• New employee orientation and current employee
refresher program
•Identify Other Opportunities for Education
• Professional business continuity planning conferences
and seminars
• User groups and associations
• Publications and related Internet sites
39

40. Phase 5 – Test, Exercise, and Maintenance
40

41. Phase 5 – Test, Exercise, and Maintenance
Test and Evaluate The Plan and Tools
•Hold a tabletop or functional exercise to test the
components of the plan
• May hold multiple drills such as a communications call
down drill off hours
• Will reveal any deficiencies or gaps in the plan as well
as strengths
• Based on an actual scenario determined by the
organizations response to real events, their HVA, RA
or BIA
•Conduct an After Action Conference / Develop
After Action Report (AAR)
• Hold a hot wash after the drill or exercise
• Develop an AAR / Improvement Plan
• Update BCP/COOP based upon AAR
41

42. Phase 5 – Test, Exercise, and Maintenance
Define Plan Maintenance Scheme and Schedule
• Define ownership of plan data
• Prepare maintenance schedules and review procedures
• Select tools
• Monitor activities
• Establish update process
• Audit and control
• Ensure that scheduled plan maintenance addresses all
documented recommendations
Formulate Change Control Procedures
• Analyze business changes with business continuity planning
implications
• Set guidelines for feedback of changes to planning function
• Develop change control procedures to monitor changes
• Create proper version control—develop plan reissue,
distribution, and circulation procedures
• Identify plan distribution list for circulation
42

43. Phase 5 – Test, Exercise, and Maintenance
Establish Status Reporting Procedures
• Establish reporting procedures
• Content
• Frequency
• Recipients
Audit Objectives
• Recommend and agree upon objectives for BCP/COOP
related audits.
• Audit the BCP/COOP plan’s Structure, Contents, and Action
Sections
• Determine if a section in the BCP addresses recovery
considerations
• Evaluate the adequacy of emergency provisions and
procedures
• Recommend improved positions if weaknesses exist
•Audit the BCP’s Documentation Control Procedures
• Determine whether the BCP/COOP is available to key
personnel
• Review update procedures
•Demonstrate that update procedures are effective
• Examine the provision of secure backup copies of the
BCP/COOP for emergency use
• List those individuals with copies of the BCP/COOP
• Ensure that BCP/COOP copies are current 43

44. Any Questions?
44

45. Contact Information
James L. Paturas, LP, CEM, CBCP, CHS-V, FACCP
Director, Emergency Preparedness
(O) 203.688.3496
(C) 203.650.7248
James.paturas@ynhh.org
1 Church Street, 5th Floor  New Haven, CT 06510
www.yalenewhavenhealth.org/emergency
45