Avalution’s March 2012 hospital perspective (Hospital Preparedness: The Intersection of HICS, Business Continuity and IT Disaster Recovery) discussed how hospitals can integrate siloed preparedness activities into a single, unified preparedness program. Since the article’s publication, Avalution received a number of questions regarding how those involved in preparedness (emergency management, business continuity, and IT disaster recovery) should interact during a response and recovery effort, and who is responsible for responding to each type of event. This article aims to answer these questions.
In most hospitals, the emergency management program (utilizing the hospital incident command system, or HICS) focuses heavily on responding to disaster situations caused by an external disruption (e.g. addressing a surge in medical care brought on by an event affecting the community). In other words, most emergency management programs view their role as a responder to external events, rather than as a potential victim of events. Some HICS-oriented emergency management programs also focus on where to redirect patients if the hospital’s physical environment is affected.
However, HICS can do so much more, and Avalution is seeing hospitals with more advanced preparedness programs using HICS processes to manage business continuity and IT disaster recovery-related efforts. As such, we believe that the integration discussed in our Hospital Preparedness article can (and should) extend into any type of hospital response and recovery effort.
Extending HICS’ Scope of Involvement
As demonstrated by the 2011 Joplin, Missouri tornado, hospitals may be required to not only triage and surge operations due to an external event in the community, but they may also need to respond as a victim of an event affecting their internal environment.
As part of the emergency management planning process, the hazard vulnerability analysis (HVA) aims to identify the potential events that could lead to a disaster in the community (thus increasing demand for hospital services), as well as the events that could lead to an interruption to the hospital itself (thus affecting its ability to provide services). The hazards identified by a HVA process could affect the hospital’s internal environment and lead to the following loss scenarios:
- Loss of facility
- Loss of technology (e.g. data center)
- Loss of people
- Loss of back office and support departments (e.g. payroll, patient finance, pharmacy)
A threat that affects the hospital’s resources is likely to affect the hospital’s ability to provide patient care, directly or indirectly. And, if patient care is affected, it should trigger HICS activation as a method of expediting a return to normal.
Leveraging the HICS Structure
In the HICS structure, the Incident Commander has the following direct reports: Operations, Planning, Logistics, and Finance/Administration Section Chief (similar to the National incident Management System, or NIMS, reporting structure). Under the Operations Section, a Business Continuity Branch Director has an IT Unit direct report, as depicted below:
This structure demonstrates the HICS-defined relationship between operations (hospital/clinical), business continuity and IT. Thus, it assumes that business continuity and IT should be involved in emergency management-related events, and Avalution believes the opposite is also true: emergency response can (and should) be involved in business continuity and IT-related events. But, how? The following case study demonstrates one hospital’s response to an event affecting the healthcare delivery-related processes and its local data center.
On a summer Sunday evening around 9PM, a fire severely damaged the west building of Hospital X’s main campus (where a number of patient care units and support departments are located, as well as one of the primary data centers). What did Hospital X do?
First, Hospital X had a long established, well-rehearsed evacuation plan that led to the successful evacuation of employees and patients located in the west building. Employees and patients were accounted for, and the HICS team gathered in the parking lot to discuss next steps. The HICS team decided to activate the emergency operations center, and the incident commander instructed the team to relocate patients to the alternate site since the other patient buildings’ census was high due to trauma season.
The public information officer began drafting messages for the media and shareholders, recorded a message on the hospital’s crisis hotline for employees, and contacted the county’s office of emergency management to notify them of the event.
Two hours later, the fire department allowed select members of the hospital’s damage unit to survey the site, although they could not enter the building due to structural damage. The damage unit reported that the building would likely be inaccessible for “weeks”, so the operations section chief and the business continuity branch director instructed the business function relocation unit to relocate support departments to their pre-defined alternate sites. Further, the business continuity branch director directed department owners to implement their IT downtime procedures, and instructed the IT unit to failover to their alternate site. In addition, IT unit rerouted telecommunications to the back up call center.
EPIC, RIS and LIS recovered within two hours at the failover data center, with other critical patient care systems coming up shortly thereafter. Supplier deliveries were postponed or rerouted based on pre-established protocols.
For many weeks after the fire, building restoration activities continued, with Hospital X carefully coordinating with local government agencies. Most back office and support departments recovered at alternate locations or from employees’ homes, albeit in a minimum capacity. After one week, all business critical systems were restored in the back up data center. All in all, Hospital X’s patients felt very little disruption (aside from the relocation), and they also felt well communicated with. Employees also felt well-treated.
This is an example of how a simple, well-established and well-rehearsed emergency management program can assist in meeting all stakeholder needs, even in a catastrophic situation.
Extending emergency management’s role in the response and recovery effort will ensure that the hospital is not only prepared to respond to a disaster affecting the community, but is also prepared to respond to and recover from a disaster affecting their internal environment and its resources. In addition, using the same integration approach as used in the planning effort will ensure that all parties contribute to the response and recovery effort in order to maximize efficiency and lessen the impact to patient care.
Avalution Consulting: Business Continuity Consulting