Introduction to Business Continuity Planning. PCDC Introduction. Objectives. MPCA Series on Business Continuity Planning

Transcription

1 Introduction to Business Continuity Planning MPCA Series on Business Continuity Planning Joan Thomas, MPA, ABPC, MEP Primary Care Development Corporation April 28, 2010 PCDC Introduction Public Private Partnership formed in 1993 to strengthen primary care in underserved communities Work throughout the United States including New York, California, Maryland, Delaware, Colorado, Alaska, and New Jersey Helped dozens of providers serving hundreds of thousands of low-income patients Capital Access Performance Improvement Health Information Technology (HIT) Emergency Preparedness Operations Improvement Policy Leadership Additional information can be found on the PCDC handout 2 Objectives Participants will comprehend the basic tenets of business continuity by creating an Executive Summary Participants will describe the components and processes of Business Continuity Planning Participants will identify the human resource requirements of the process by creating a draft business continuity team Participants will demonstrate knowledge of the Business Impact Analysis (BIA) by completing the first steps of a BIA 1

2 What is Business Continuity? Part of a successful business plan Well researched, all-hazards effort to ensure capabilities are developed d to maintain i business operations before, during and after a disaster Ensures that the necessary steps are taken to: Identify the impact of potential losses Maintain viable recovery strategies, recovery plans, and continuity of services What is Business Continuity? An ongoing process supported by senior management and funded by the organization Example: What would you do if you arrived at your health center and there was two feet of water on the floor throughout the facility? What is Business Continuity Planning? Advance planning and preparations which are necessary to identify the impact of potential losses Formulate and implement viable mitigation and recovery strategies Develop recovery plan(s) which ensure continuity of organizational services in the event of an emergency Administer a comprehensive training, testing and maintenance program 2

3 What Business Continuity & Planning is NOT It is NOT an emergency management plan It does NOT focus on specific events but instead on the processes a business utilizes every day Importance of Business Continuity Financial implications Stay in business! Continue the income flow 25% of all small businesses never recover from a disaster Health centers lose on average $12,000 to $30,000 each day they are closed Statistics indicate that 50% of businesses which sustain interruptions of a week or more due to problems at the primary site never recover. Importance of Business Continuity Community implications Maintain a level of service to the community Disasters are the time when communities need their local health systems the most Establishes good will as well as external credibility with clients, vendors, and the community Staffing implications Keep staff whole! Long time staff are trained / qualified, have institutional knowledge and loyal patients. Losing them because of downtime related to disaster could seriously impact a health center Establishes good will as well as internal credibility with staff 3

4 Business Continuity Justification ACTIVITY Justify Business Continuity Planning for your organization by creating an Executive Summary 1. Think about the reasons just discussed as to why an organization should complete a business continuity plan 2. Within your group, list the reasons your organization should complete a business continuity plan on the Executive Summary Form (Part A) a) Use a combination of your own reasons and the ones listed here 3. Choose the top 3-5 reasons 4. Using the Executive Summary Form (Part B), insert those 3-5 reasons in the space provided Business Continuity Plan Components Executive Summary Business Continuity Team / Key Personnel Hazard and Vulnerability Analysis (HVA) and Business Impact Assessments (BIA) Inventory of Critical Assets Mitigation, Response and Recovery Strategies Communication Plan Training, Testing and Revision Business Continuity Planning Process Get appropriate buy in Leadership / Senior Management this is imperative! Board of Directors Staff Vendors (i.e. Information Technology, Human Resources, Payroll Service) Build the BCP Team Complete a Business Impact Analysis Identify which processes are critical and non-critical Identify and create mitigation and recovery strategies Acquire any additional resources Training, testing and revision 4

5 Building The Business Continuity Team Role of the Business Continuity Team Leads the research Builds the Business Continuity Plan Reviews the finished Business Continuity Plan with the organization to ensure accuracy Building The Business Continuity Team Who should be on the Business Continuity Team? May be comprised of an existing Emergency Preparedness Committee or create a new team to focus on business continuity Ideally have a representative from the following departments: Medical / Clinical (RN & MD) Administrative (i.e. Office Manager) Health Information Technology Facility Operations Finance / Accounting Human Resources Other business units Business Continuity Planning Team ACTIVITY Using the Business Continuity Team Roster, identify your site BCP Team. Issues to consider when choosing members: Cover all business units (departments) previously mentioned Resources (staff time, funding, etc.) should not be a major consideration if you have appropriate buy in from senior management 5

6 Hazard Vulnerability vs. Business Impact Analysis (HVA) Analysis (BIA) Event focused Process focused A systematic approach to identify, assess, and prioritize each hazard that may affect a community to show vulnerabilities Assessing an organizations financial and non-financial exposure to sudden loss of critical business functions and resources, due to an emergency The vulnerability is related to both the impact on the organizational function and the likely service demands created by the hazard impact Hurricane Sever Thunderstorm Fire Earthquake The purpose is to identify, prioritize and document the relative importance of various business processes conducted by business units (departments) Patient Care Billing & Payroll Patient Records Supply Management Components of a Business Impact Analysis Process A systematic series of activities or tasks that produce a specific end Citi Critical essential functions that t are important t to the mission of the organization and must be maintained during an emergency event (Is it essential today?) Example: Running water for the health center Non-critical plays an important function to the organization but not essential during an emergency event Example: Schedule routine patient visits Components of a Business Impact Analysis Considerations when reviewing your Processes Time How much time can you wait for this process to be functional? What is the acceptable downtime? Data What amount and type of data can be unavailable so that you can still be open for business without severely impacting business operations? Understand Regulatory and Legal Requirements 6

7 Business Impact Analysis ACTIVITY Begin your Business Impact Analysis Use the Organization Business Processes Form to identify and list as many of your organizations processes as you can Use the Organization Processes List to help you brainstorm Determine whether each process is critical or non-critical and mark on the form under Priority Prioritize the critical processes in order of importance to the organization Next Steps Complete the Executive Summary including Senior Leadership signature (buy in) Identify yyour Business Continuity Team Continue the BIA for your organization Continue to identify all organization processes by interviewing each staff member. Use the Critical Business Process Form for each individual function. Continue to label each process as critical or non-critical Once complete, prioritize the critical processes in order of importance to the organization Questions? 7

8 Thank you for your participation! Brian Silva, EMT, MPA Joan Thomas, MPA, ABPC, MEP Key Terms in Business Continuity Hazard: a potential or actual force with the ability to cause loss or harm to humans or property Vulnerability: how susceptible resources are to the negative effects of hazards including: The likelihood of a hazard occurring Mitigation measures taken to lessen the effects of hazards Risk: is the effect of hazard combined with vulnerability Research NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs, National Fire Protection Association Ready New York for Business, New York City Office of Emergency Management Institute for Business and Home Safety Okamoto, K. Making the Most of the Worst, Disaster Recovery Journal Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook Primary Care Development Corporation 8