Business continuity plans are the lifeline for keeping healthcare organizations viable and operational in order to provide care for the community during and after an emergency. During an event such as the COVID-19 pandemic, healthcare organizations must activate both their required emergency preparedness plans and their business continuity plans. An emergency preparedness plan is intended to prepare for and address an ongoing emergency, whereas the business continuity plan reduces economic impact to the organization during an event, allowing it to maintain critical business and logistical functions. Further, business continuity plans help healthcare organizations recover and get back to business as usual more quickly and effectively.
Effective emergency management and business continuity start with a business continuity team that can tackle the plan development in phases. Healthcare organizations should start with a hazard vulnerability analysis (HVA), which is the cornerstone of every business continuity plan. An HVA assesses the risk, preparedness and impact for an individual healthcare organization according to hazards of any kind, including natural disasters, infrastructure failures, security threats, mass casualty events and now the addition of infectious diseases (e.g., Ebola, Zika and COVID-19).
As part of the HVA, human, property and business impact assessments outline an organization’s risk, probability and severity to pinpoint its essential operations and the related consequences of disruption. They can also be helpful to establish a recovery timeline, which indicates how long a function or service can be down, and a recovery point, which specifies the acceptable amount of data or time that can be lost for each specified function.
Next, identify and prioritize essential services at a departmental level while taking into consideration the HVA. Assign a scoring identifier, such as 1, 2 and 3, with 1 being the highest priority. For example, if a function can be down for only a few hours before life, safety or immediate negative financial impact occurs, that function should be at the top of the priority list.
- Priority 1: Functions that have an immediate threat to employee or patient safety and welfare and/or an immediate negative economic impact if not continually performed. The function must remain uninterrupted or be performed every few hours to prevent an immediate negative impact (365/24/7).
- Priority 2: Functions that, if stopped or delayed, would cause a major negative impact to the healthcare organization and stakeholders. Some services may be required by contractual obligations with vendors, employees or patients, both external and internal. The function can be disrupted temporarily or might be periodic in nature but must be reestablished within 24 to 48 hours.
- Priority 3: Functions that are required by contractual obligations with vendors, employees or patients, both external and internal, or that would cause a minor negative impact if suspended or delayed. The function may be disrupted temporarily or could be suspended during an emergency and resumed as soon as possible.
After identifying and prioritizing services and functions, the next step is determining the resources necessary to carry out each service. This should include memorandums of understanding with all partners, third parties and suppliers. Think broadly when compiling a list of required resources, which should include physical equipment and IT infrastructure and detail any special skills required to perform functions and associated dependencies (i.e., functions that must be in place in order to carry out a different service). Also, determine the number of personnel trained and qualified in this service, which will help to more easily reallocate resources. An organizational matrix that details the skill sets required for all essential roles will ensure that they remain filled. Additionally, maintaining an updated record of employee-related information such as licenses and certifications and completed training will allow healthcare organizations to fill essential roles and facilitate demobilization of workers within the organization as needs arise.
Last, an after-action report is an important tool used to provide feedback after an event. It summarizes what took place during the event, analyzes the actions taken by participants and provides areas needing improvement. An after-action report also enables the tracking of organizational compliance and, most important, allows an organization to update the business continuity plan (and emergency operations plans), which should be updated annually. Create a central repository for the after-action report and other documentation to ensure that all staff access from any location to the latest version. Based on the after-action reports, update memorandums of understanding with community partners.
This checklist can help ensure that healthcare organizations are fully prepared to weather the current COVID-19 pandemic, as well as any future interruptions that may arise:
Business Continuity Plan Checklist
- Issue regular, transparent communications that reassure employees and align with current communication protocols. Communication plans should balance caution with a business-as-usual mindset.
- Monitor state and federal initiatives of support such as 1135 waivers and the CARES Act, including being mindful of all documentation requirements.
- Determine how the event affects budgets and business plans to assess financial and operational risks, including the evaluation of short-term liquidity (e.g., terms and conditions on loans and contracts with creditors and investors).
- Consult legal teams for advice on potential liabilities and risk mitigation.
- Review and renew business continuity plans by department or service.
- Utilize memorandums of understanding with community, state, and local authorities and vendors.
- Stay in contact with suppliers regarding ability to accommodate supply chain needs, reset business assumptions and update memorandums of understanding, as necessary.
- Make decisions and take actions during the crisis with recovery in mind.
- Execute revised strategies and continue to monitor the situation.
For more on emergency management, including business continuity plans, listen to our recent webinar.
