Medical Practice Business Continuity Planning: It's Worth the Time

In the normal course of events, almost nobody can justify the investment of time and money required for business continuity planning. It is expensive in terms of both time and money; the plan is out of date as soon as it is completed; and the return on investment is, arguably, non-existent.

It takes something like Hurricane Sandy to remind us that disasters do happen and the consequences can be severe.

Definitions

Business continuity (BC) is the activity of ensuring that key organizational functions are reliably available to all stakeholders - patients, providers, regulators, and any other entity that must have access to those functions. The term is often associated with the ability for a business (or practice) to continue to function in spite of major disruptions, but it also applies to regular operations. Disaster recovery (DR) is an important subset of BC and focuses on the recovery or availability of data and the technology infrastructure that support key functions.

Elements of a Business Continuity Plan (BCP)

Operations Manual

The first element of a robust BCP is an operations manual. A comprehensive description of normal operations provides a list and definition of a practice's normal functions.

Business Impact Analysis (BIA)

The purpose of the BIA is to rate functions

• How important is the function?  Critical/Important/Useful

• How long can the function be out of service without causing serious harm? 
1 hour/ 1 day/ 1 week/ 1 month

This is the most difficult part of the BCP process. Do not be surprised if every function is initially designated as critical and cannot be suspended for more than one hour. In order to get some differentiation in the importance rating, it can be helpful to compare two specific functions and ask which of the two is most important. Similarly, in terms of time criticality, ask what will happen if the function is not available for longer than the chosen period. If the consequence is minor, a longer period of unavailability is appropriate.

Prioritize the functions based upon the BIA

A function's priority is based upon both its criticality and time sensitivity, and the results can be counterintuitive. Insurance claim filing may be critical but, with access to sufficient reserve funding, it could be suspended for one month without causing serious damage. Reminder calls for the next day's appointments may be Important, but they would have to be made within a few hours to be useful. Both functions would have a low priority in the immediate aftermath of a disruption.

Develop contingency plans

Beginning with critical items, develop plans for coping with the most likely disruptions: unavailable staff, loss of electrical power or water, loss of communications - voice and/or data - access to premises, etc. In the case of insurance claim filing, the BCP task would be to establish a line of credit equal to two months of operating expenses. A plan for contacting staff is always necessary, including alternate phone numbers and secondary contacts.

Exercise the BCP regularly

Practice procedures and resources are in a perpetual state of flux, which is not necessarily a bad thing. The problem is that major disruptions are relatively few and far between. If the plan is not reviewed and tested regularly, the odds are good that it will no longer be applicable when it is needed most. One way to exercise the plan is a "table-top exercise." Participants sit around a table and are presented with a scenario. They look to the BCP to see how it would address the situation and amend the plan as needed. As for EHRs, the best way to test a BCP plan for down time is to pretend that the system, or communication to it, is down.

The bad news is that BCP is a big job and it is never finished, but there are three pieces of good news. The first is obvious: If BCP is done well, the risk of practice disruption is significantly mitigated. The second is the act of planning makes the practice better able to respond to a crisis, whether or not the plan anticipates the specific issue. The third piece of good news is subtler. Good BCP requires clarity about normal operations. It highlights gaps, poor practices, and wasted resources so that they can be addressed for better outcomes every day. The positive impact on normal operations is the only return on the BCP investment that is certain to be realized.

Caveat: There is no such thing as a perfect BCP, and any exercise at all is better than nothing. Decide upon an acceptable investment of time and money, and limit the BCP project to that.