JC EM Conference 2013 -Paturas

1

Emergency Preparedness Conference: Emergency Preparedness Conference:

2013 “Is Recovery Ever Really Over?2013 “Is Recovery Ever Really Over?

The Joint CommissionThe Joint Commission

Las Vegas, NV May 1-2, 2013Las Vegas, NV May 1-2, 2013

Building Hospital Resiliency: Utilizing a Holistic Building Hospital Resiliency: Utilizing a Holistic Approach to Respond and Recover from a Approach to Respond and Recover from a

DisruptionDisruption

2

Yale New Haven Health System

Westerly YSM

Largest, most integrated healthcare system in Connecticut with $2.6 billion in revenue 18,435 employees and 5,675 physicians 93,923 patient discharges and 1,397,632 outpatient encounters 2,130 licensed beds 6 hospitals (including a Level 1 Burn Center and a Level 1 Trauma Center), a children’s

hospital, a psychiatric hospital, a comprehensive cancer hospital, a physician practice organization and ancillary primary, urgent and emergent care facilities

Other clinical affiliations include the YNHHS Heart Institute, Pediatric Network, Telestroke Network and Cancer Network with other area hospitals

501c3 nonprofit organization

Bridgeport Greenwich Yale-New Haven Northeast Medical Group (NEMG)

Yale Medical GroupYSM

Bridgeport Greenwich Yale-New Haven

3

Objectives

• History of BCP/COOP• Terminology• Standards and Compliance• BCP Challenges & Pitfalls• Tips to develop a HVA and BIA•Identify your essential functions•Identify the components of a BCP/COOP•Learn how to test and evaluate your BCP/COOP•Discuss review and maintenance of BCP/COOP

Objectives

4

Overview

• Event Event • History of BCP/COOPHistory of BCP/COOP• TerminologyTerminology•Standards and ComplianceStandards and Compliance

5

5

BCP/COOP EventC

apab

ilit

y

Time

Normal OperationsIncident Occurs

RecoveryTime Objective

Contingency Planningand Crisis Management

Proactive HCC Activities

Proactive HCC Activities

Reactive HCC Activities

Risk Mitigation

modified U.S. DoD graphic

Response, Recovery & Restoration

Prevention and Preparedness Prevention and Preparedness

Return toNormal Operations

Recovery

Emergency Response Restoration

Used by courtesy of The Virtual Corporation

Minimum Acceptable Levelof Capability

6

Overview

• BCP/COOP should be an organization or department-wide initiative utilizing a holistic approach to prepare the organization to recover after an interruption of its essential functions and business operations.

• Taking an holistic approach to organizational resilience will allow hospitals and health systems and the communities they serve to fully embed business continuity and continuity of operations into their fabric.

• The process involves assessing, developing, testing, and maintaining a system-wide business continuity/continuity of operations plan which addresses any type of disaster covering key technical, operating, business and clinical functions.

• In general, the process undertaken will occur in multiple steps over the course of approximately 18-36 months.

7 7

Business Continuity Plan vs. Continuity of Operation Plan

• The terms Business Continuity Plan (BCP) and Continuity of Operations Plan (COOP) are used interchangeably

• According to the Business Continuity Institute, a Business Continuity Plan (BCP) is a document containing the recovery timeline methodology, test-validated documentation, procedures, and action instructions developed specifically for use in restoring organization operations in the event of a declared disaster.

• Continuity of Operations Plan (COOP) – Organized processes that facilitate system restoration for emergencies, disasters, mobilization, and for maintaining a state of readiness to provide the necessary level of information processing and business functions commensurate with the mission requirements and priorities.

• In either case, the ultimate goal of developing a BCP/COOP is to provide procedures and capabilities for sustaining essential organizational business and clinical operations and strategic functions while recovering from a significant disruption

BC

P

8

BCP/COOP Standards & Regulations

The goal of any standard is to follow a clearly structured good practice guide to how to develop a Continuity Management System (CMS) and to be able to audit and monitor the COOP practices of organizations

• National Security Presidential Directive 51/Homeland Security Presidential Directive 20, National Continuity Policy, May 9, 2007.

• Public Law 109–417, the Pandemic and All-Hazards Preparedness Act (PAHPA) was passed that included SEC. 2802.

• BS 25999, the British Standard for Business Continuity Management established by the British Standards Institution., is becoming widely accepted around the globe as the de facto international standard

• Its nearest competitor is the US National Fire Protection Association’s NFPA 1600 standard Standards on Disaster/Emergency Management and Business Continuity Programs

• Joint Commission Hospital Accreditation Program (HAP) 2010, EM.02.01.01

9 9

BCP/COOP Pitfalls & Challenges

Pitfall # 1 – Not having a plan(s)

• Huge risk to the core business, operational and clinical functions of the organization

• Potential loss immeasurable and the risk of legal liabilities

Pitfall # 2 – Not maintaining plans

• Require routine maintenance/updating

• Must be dynamic and evolve as threats change

Pitfall # 3 – Not exercising or testing plans

• Contingencies are not part of normal operating procedures

• Exercises must cover several types of contingencies

Pitfall # 4 – Not raising awareness of plans• Contingencies affect everyone in the organization

• Changes or updates to plans require acquainting staff with new procedures

10 10

Pitfall # 5 – Not identifying essential functions

• Not everything is mission essential

• Need to identify and prioritize critical assets

Pitfall # 6 – Not identifying key roles and responsibilities

• Chain of Command/Span of Control are essential

• Must reflect current staff and their contact information

Pitfall # 7 – Not coordinating plans with partners

• Many interdependencies exist in a crisis/disaster

• Establishes boundaries, roles and responsibilities


11 11


• One of the challenges that prevents organizations from taking full advantage of a holistic approach is the presence of organizational silos

• Most organizations, especially larger ones, are actually a conglomeration of many different divisions, departments, business units and operations.

• These are often structured as silos and in some cases are self contained, self managing entities which have minimal interaction and communication with other parts of the organization.

• Despite this apparent autonomy they normally have strong dependencies on services provided by other parts of the organization, such as IT, purchasing, finance, human resources and payroll to name a few.

• Lack of transparency, uncooperative managers, unwillingness to buy into the BCP/COOP process and organizational politics are common aspects of silos.

12 12

• No organization is an island and one of the larger challenges to holistic BCP/COOP is how to ensure that critical suppliers are not a single point of failure and are not at risk of downtime.

• This is especially true when an organization is outsourcing critical business infrastructure, such as IT services, to third parties.

• As part of the holistic BCP/COOP process suppliers should be mapped and critical suppliers should be identified.

• Once identified it is important to determine:• What contracts have been agreed with these companies• What BCP/COOP arrangements do suppliers have in place• Are there alternative suppliers readily available


13

Phased Approach

1-3 Months 6-9 Months 9-12 Months 12 Months Ongoing

14

Phase 1 - Project Initiation

C-Suite Buy-In

15

Phase 1 – Project Initiation

Establish Governance and Obtain Buy-In

•Meet with Senior Leadership

• Obtain commitment from leaders

• Present the goals and objectives

•Establish Planning Team / Steering Committee

• Develop Team Guidance / Governance

• Scope / Assumptions / Mission Statement

•Establish Project Timeline

• Outline project milestones and goals

• Finalize overall project schedule

• Identify project team

16

16

BCP/COOP Steering Committee Provide hospital or healthcare system-wide business continuity

planning project oversight to support the planning, response, resumption, recovery and restoration of operations

The following is a list of individuals from the your healthcare organization that should comprise key decision makers representing clinical, administrative, business, technology and support services

– Senior Executive– Administration – Operations – Legal/Compliance – Information Systems & Technology – Human Resources – Facilites – Financial Services – Medical Affairs – Risk Management– Patient Care Services – Emergency Management


17


17

BCP Project Support Team

The BCP/COOP Project will be coordinated by the BCP/COOP Project Team. These members serve as the BCP/COOP project liaisons and provide day-to-day support and integration of all BCP/COOP activities. The following are the BCP/COOP Project Team members.

Project Manager Project Lead Point of Contact (POC) Project Database Administrator IS&T Disaster Recovery BCP/COOP Training and Planning Specialist Emergency Management Specialist Clinical Liaison Financial Liaison Risk Management BCP/COOP Consultants (prn))

18

Phase 2 - Business Impact Analysis

BIA

19

Conduct a Business Impact Analysis

•Determine your Vulnerability / Hazards

• Review Hazard Vulnerability Analysis (HVA)

• Review Risk Assessments (RA)

• Review Past History of Storms

• Discuss with Emergency Management Officials and other emergency response organizations in the community


Human Resources

Surge Capacity

20

Determine your Business Impact

Defined by Disaster Recovery Institute International (DRII) as:

“Identifying the impacts resulting from business interruptions that can affect the organization and techniques that can be used to quantify and qualify such impacts.”

PROVIDES THE BASIS FOR YOUR BCP/COOP


21

Determine your Business Impact

•Gather data via a survey or questionnaire

• Can be distributed to all employees or select management group who can provide an overview for the entire organization

• Asks targeted questions about what is critical to the organization

• Determines impact if the service was not available for a few days

• Determines any relationships between other departments or organizations

•Follow Up with specific questions

• For anything that is not clear, conduct a follow up interview or observe this service to see how it effects the business

• Aim to truly define what are essential functions

• Could be conducted in a group setting


22

Determine your Business Impact•Analyze / Review Data

• Identify the main areas of the organization

• Assess the impact of disruptions

• Loss of staff

• Loss of equipment

• Perception by the public

• Regulatory requirements

• Financial

• Environmental

• Relationships (Public and Partners)

• Determine minimum needed resources and staff to carry out

• Can this service be carried out remotely?

• Determine once interrupted how long will it take to restore services


23


Identify Time-Sensitive Business Operation Processes and Application Systems

• Establish a method of grouping clinical, business and operational processes and technology application systems in line with their importance to the overall function of the organization like business time-sensitivity ratings.

• Time-sensitivity ratings are usually expressed in terms of the minimum and maximum time that the organization can withstand an interruption of a particular clinical and/or business operation or technology application system.

• Record each clinical business and operational processes, functions or technology application systems along with its time-sensitivity rating.

• A comprehensive BCP/COOP will document a single or multiple strategy and tasks for every level of business time-sensitivity.

24

Hazard Vulnerability Analysis

Kaiser Permanente Model - http://www.nachc.com/EM-Planning.cfm

• Mainly used for healthcare facilities, but can be adapted for public health use


25 25

Step 2 – Business Impact Analysis

Example of a Business Impact Analysis survey that was completed by functional managers of departments/work units and ideally use a computer-based data collection tool

The chart below identifies actual data of survey responses conducted at a healthcare system based on their title and positions

71%

10%

5%

3%2%

2%7%

Directors

Managers

Vice Presidents

Coordinators

Assistants

CIOs

Other

26

26

Patient Care Adverse

Patient

Outcome

Patient

Confi denceRegulatory

Compliance Liability Cash Flow

86%84%

77%

70%

57%

48%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

Examples of Departmental Responses to a Disruption

Percentage of Survey Responses

Type of Impacts

Step 2 – Business Impact Analysis

Percentage of Survey Responses

Type of Impacts

27

Phase 3 – Plan Design and Development

28


Based Upon HVA and BIA

• Plan for the most probable and highest impact events

• May want to include hazard specific annexes

• i.e. how workforce will be protected from Pandemic Flu

Defines Roles and Responsibilities

• Who is responsible for what during a BCP/COOP activation

• May not be the traditional department / personnel

Identifies Triggers for Activation / Devolution

• Who is responsible for activating the BCP/COOP

• What is the trigger for activation (storm warning, absenteeism rate, etc.)

• Is this a facility specific emergency or disaster?

• When should you return to normal operations?

29


The Concept of Operations describes the procedures for BCP/COOP plan implementation.

BCP/COOP plan implementation takes place in four phases:

• Phase I: Readiness and Preparedness

• Phase II: Activation and Relocation (0–12 hours)

• Phase III: BCP/COOP Operations (12 hours–30 days or until resumption of normal operations)

• Phase IV: Reconstitution (recovery, mitigation, and termination)

Phase 1

Phase 2

Phase 3

Phase 4

Emergency

30


Identifies How Communications with Employees and Organizations are Carried Out

• Do you have a 24/7 contact list for ALL personnel and how to notify employees?

• Emergency notification system

• Department cell phone numbers, office numbers, e-mail

• Home number, personal cell phone, home email

• Are they capable of receiving texts?

• Agency 24/7 contacts

• Social media uses (websites, Twitter™, Facebook™)

• Mass notifications systems

• Two-Way Radios

31


Outlines Order of Succession / Delegation of Authority

• Orders of Succession

• In the event a person cannot carry out their duties, outlines who is responsible for that duty

• Should have a backup and a backup’s backup

• May not be the organization’s traditional organization chart

• Should be outlined by position and duty (i.e. different person will have different responsibilities for a natural hazard vs. a pandemic flu)

• Ensure 24/7 contact information for all parties

• Performance of unusual or additional duties by staff or reassignment

• Delegation of Authority

• Delegations of authority are formal documents specifying the activities that may be performed and the legal authority of those authorized to act on behalf of the agency head or officials

• Delegations of authority ensure rapid response to any emergency situation requiring BCP/COOP implementation

• Identify the authority being delegates, to whom it is being delegated, limits of the authority, when authority would terminate

32


Define How Essential Functions Will Be Carried Out / Concept of Operations

• First essential functions are defined

• What functions must your organization carry out

• Then essential functions are prioritized

• Defines who is responsible for these functions

• Agency / Department / Person

• Are they aware of their 24/7 responsibility

• Are there any duties that can be suspended during a BCP/COOP?

• Permitting Processes

• Inspections

33


Alternate Work Locations / Telework Arrangements

• Do you have an alternate location should your office become unusable?

• Is it equipped or do you need to bring supplies with you?

• Can employees telework in the event of an emergency?

• Do they have the right equipment to telework?

• Who is essential vs. non-essential personnel

• Are there other agreements for use of the facility by other departments?

• Has a HVA or RA been completed for that building?

• Does your employees need training to use this facility or its equipment?

34


Integration with EOP / EMP

•Is your plan NIMS / ICS Compliant

•Can it be integrated with your organization’s Emergency Operations Plan (EOP) and / or Emergency Management Plan (EMP)

•Are there any duplicative roles for your personnel or unrealistic roles or responsibilities

•Do your personnel understand their roles in all plans?

35

35

Other Considerations• Design a consistent departmental/work unit BCP/COOP format and structure used across all

delivery networks that is integrated with the existing emergency management processes:


Overview– Recovery Plan Overview– Plan Distribution & Storage– General Plan Scope

Recovery Team Task Lists– Recovery Team Roles & Assignments– Delegation of Authority– Department Response Team Procedures

– Loss of Bldg Access– Loss of Key Personnel– Loss of IT Applications– etc.

– Resumption of normal operations Call Lists

– Department Call List– Vendor Call List– Personnel Notification Procedure

Recovery Resources– Internal / external personnel– Environmental Resources– Fixed and Portable Medical Equipment– Critical Supplies

Strategy Support Materials– How All BCP/COOP Plans Fit Together– Department Planning Assumptions– Directions to Recovery Location

Forms– Activity Log– Move and Relocation Forms– Plan Testing and Maintenance procedures

Reference Materials– Recovery Time Objectives (all depts)– Business Impacts (all depts)– Dept Business Impact Analysis Findings– Business continuity policies– Physical and security assessments– Vital records and off-site storage program– Department and corporate succession

plans– Budget considerations for capital and

operating expenses Links to Emergency Response Procedures

– Damage impact assessment procedures– Command center activation procedures

36


36

Other Considerations

• Expand usage of the “Hospital Incident Command System” (HICS) to define responsibilities, clear reporting channels, and a common nomenclature to help unify hospital recovery and restoration activities with other emergency responders

• Add the position of Business Continuity Branch Director to each HICS Incident Management Team structure

• Reports through the Operations Section Chief

• Update all HICS Job Action Sheets (JAS) addressing “Recovery Role” for ICS personnel

Incident Commander

Planning Section Chief

LogisticsSection Chief

Operations Section Chief

Finance/

Administration Section Chief

Liaison Officer

Medical/Technical Specialist

Safety Officer

Public Information Officer

Procurement Unit Leader

Compensation/Claims

Unit Leader

Time Unit Leader

Cost Unit Leader

Service Branch Director

Support Branch Director

Resources Unit Leader

Situation Unit Leader

Documentation Unit Leader

Demobilization Unit Leader

Staging Manager

Medical Care Branch Director

Infrastructure Branch Director

HazMat Branch Director

Security Branch Director

Business Continuity

Branch Director

Hospital Incident Command SystemIncident Management Team StructureAugust 2006

Power/Lighting UnitWater/Sewer UnitHVAC UnitBuilding/Grounds Damage UnitMedical Gases UnitMedical Devices UnitEnvironmental Services UnitFood Services Unit

Inpatient UnitOutpatient UnitCasualty Care UnitMental Health UnitClinical Support Services UnitPatient Registration Unit

Detection and Monitoring UnitSpill Response UnitVictim Decontamination UnitFacility/Equipment Decontamination Unit

Access Control UnitCrowd Control UnitTraffic Control UnitSearch UnitLaw Enforcement Interface Unit

Information Technology UnitService Continuity UnitRecords Preservation UnitBusiness Function Relocation Unit

Personnel Staging TeamVehicle Staging TeamEquipment/Supply Staging TeamMedication Staging Team

Personnel TrackingMateriel Tracking

Patient TrackingBed Tracking

Communications UnitIT/IS UnitStaff Food & Water Unit

Employee Health & Well-Being UnitFamily Care UnitSupply UnitFacilities UnitTransportation UnitLabor Pool & Credentialing Unit

Biological/Infectious DiseaseChemicalRadiologicalClinic AdministrationHospital AdministrationLegal AffairsRisk ManagementMedical StaffPediatric CareMedical Ethicist

37

Phase 4 - Plan Implementation

38

Phase 4 – Plan Implementation

Distribution

•Distribute plan to all personnel and outside agencies who have a role in the BCP/COOP

• Ensure that Emergency Management, Public Health & Jurisdictional Authorities have a copy

• Maintain a record of distribution for updates and changes

• Ensure Control Procedures

Develop Training

•Being to develop awareness training and exercises with the following goals in mind

• Ensure that all participants are aware of their roles and responsibilities

• Ensure all know how the office will function during a BCP/COOP (Telework, Essential Personnel, etc.)

• Hold a full scale exercise so all can see how plan is activated and difference for normal working conditions and a BCP/COOP situation

39

Phase 4 – Plan Implementation

Deliver Training

•Deliver Various Types of Training Programs as appropriate

• Computer-based

• Classroom

• Test-based

• Instructional guides and templates

•Develop Awareness Programs

• Management

• Team members

• New employee orientation and current employee refresher program

•Identify Other Opportunities for Education

• Professional business continuity planning conferences and seminars

• User groups and associations

• Publications and related Internet sites

40

Phase 5 – Test, Exercise, and Maintenance

41


Test and Evaluate The Plan and Tools

•Hold a tabletop or functional exercise to test the components of the plan

• May hold multiple drills such as a communications call down drill off hours

• Will reveal any deficiencies or gaps in the plan as well as strengths

• Based on an actual scenario determined by the organizations response to real events, their HVA, RA or BIA

•Conduct an After Action Conference / Develop After Action Report (AAR)

• Hold a hot wash after the drill or exercise

• Develop an AAR / Improvement Plan

• Update BCP/COOP based upon AAR

42


Define Plan Maintenance Scheme and Schedule• Define ownership of plan data• Prepare maintenance schedules and review procedures

• Select tools• Monitor activities• Establish update process• Audit and control

• Ensure that scheduled plan maintenance addresses all documented recommendations

Formulate Change Control Procedures• Analyze business changes with business continuity planning implications• Set guidelines for feedback of changes to planning function• Develop change control procedures to monitor changes• Create proper version control—develop plan reissue, distribution, and circulation procedures• Identify plan distribution list for circulation

43

Establish Status Reporting Procedures• Establish reporting procedures

• Content• Frequency• Recipients

Audit Objectives• Recommend and agree upon objectives for BCP/COOP related audits.

• Audit the BCP/COOP plan’s Structure, Contents, and Action Sections

• Determine if a section in the BCP addresses recovery considerations• Evaluate the adequacy of emergency provisions and procedures• Recommend improved positions if weaknesses exist

•Audit the BCP’s Documentation Control Procedures• Determine whether the BCP/COOP is available to key personnel• Review update procedures•Demonstrate that update procedures are effective• Examine the provision of secure backup copies of the BCP/COOP for emergency use• List those individuals with copies of the BCP/COOP• Ensure that BCP/COOP copies are current


44

Any Questions?

45

Contact Information

James L. Paturas, LP, CEM, CBCP, CHS-V, FACCPJames L. Paturas, LP, CEM, CBCP, CHS-V, FACCPDirector, Emergency Preparedness

(O) 203.688.3496(C) 203.650.7248

[email protected]

1 Church Street, 5th Floor New Haven, CT 06510

www.yalenewhavenhealth.org/emergency

Health & Medicine

JC EM Conference 2013 -Paturas