Business Continuity Disaster Recovery

1
Business ContinuityDisaster Recovery

• Are You Ready??

2
Definition of Crisis Management Planning

• The advance planning and preparations which are
  necessary to minimize loss and ensure continuity
  of the critical business functions of an
  organization in the event of a disaster.

3
Preparing for Disaster A Toolkit to assist
preparing to respond to a crisis

• Today's Objectives
• Identify and prioritize areas of risk for your
  business
• Select a compilation of forms to start your own
  plan
• Create an employee calling tree, key contacts
  forms and critical patient list
• Prepare a test for your plan

4
Business Impact Analysis

• Financial risk (of loss) and what your
  organization can withstand need to be defined
  separately. Consider a formula that extrapolates
  hours to days
• How long is your average patient willing to wait
  for your business to be restored?
• BIA includes a thorough stress test of back up,
  restoration and interdependency (V/D) processes
  for critical applications

5
BIA - more

• You need to
• Identify points of failure in your network
• Identify need for robust voice/data restoration
• Identify how Reputational loss will affect your
  business

6
BIA 10 top questions to ask

• 1. What are your most critical business
  processes?
• 2. If those systems were no longer available,
  how would you function?
• 3. How do you currently mitigate risk of
  compromised IT systems?
• 4. What is your recovery initiation process for
  compromised or destroyed systems?
• 5. How will employees respond to a catastrophic
  event if your business is evacuated?

7
Top 10 - continued

• 6. If you are no longer able to access your
  office, how will you restore critical functions?
• 7. If you face a disaster scenario, what is your
  communication process to employees, authorities,
  etc.?
• 8. Do you have policies/procedures established
  to keep your company in business post-disaster?
• 9. Do you have measurable benchmarks for
  effective response, recovery and restoration
  programs?

8
Top 10 not the least

• 10. Do you test (and how often) your BCP? Do
  you know where to find those results?
• TEST!!
• TEST!!
• TEST!!
• TEST!!

9
Business Impact Analysis Key Points

• Clearly define critical business and restoration
  processes
• Strategize BCP by reviewing current operational
  service levels
• Identify personnel responsible for determining
  BCP launch
• Confirm authorization and security access for
  launch and restore personnel
• If a building is evacuated identify alternate
  site needs or telecommuting standards

10
Key Points BIA..

• Can you service your patients from an alternative
  location or a similar (non-competitive) business?
  Think out of the box
• Utilize industry standards to guide decision to
  launch BCP or determine functional status
• DO NOT SKIP TESTING!!!
• Study and repair routine test results and
  deficiencies
• Disasters should not be used to fix known problems

11
Testing Validation

• Define roles/ responsibilities by abilities/skill
• Designate subject matter experts for efficient
  recovery
• Plan testing is critical
• Use DR plan for small outages
• Be aware that some accrediting bodies now require
  plan drills, i.e., Joint Commission
• Testing identifies DR deficiencies

12
Your to-do list

• Assemble a small team of management from your
  organization
• Review each of the six short chapters in the
  Toolkit and review the material within
• www.hmehurricane.com
• Download and print the Toolkit and complete the
  worksheets
• Spend some time discussing your companys
  response to a prospective crisis

13
Risk Assessment

• Consider what kind of likelihood a risk poses to
  your business or area
• Consider what severity level you feel that risk
  would pose to your business
• Based on your analysis, determine which risks
  merit a significant part of your focus/plan
• Consider setting those priority items as risks
  that youve determined to be reasonably possible
  and which have a medium or high severity to your
  business

14

• 1 - Insurance

15
Insurance

• Meet with your insurance provider annually to
  review current coverage for such things as
  physical losses, flood coverage and business
  interruption.
• Exception If you are substantially growing,
  review coverage for property and liability more
  frequently.

16
Insurance

• Consider how you will pay employees and creditors
  in the event of a business interruption
• Business Income/Business Interruption/Loss of
  Income riders frequently are included in property
  policies (e.g. 25,000)
• Additional increments may be purchased for
  relatively low amounts (e.g., 50K for 100)

17
Insurance

• Plan how you will provide for your income if your
  business is interrupted
• About 1/3 of current VGM Insurance Inc. customers
  carry business interruption/loss of income
  insurance
• Actual Case First Call Pharmacy (New Orleans)
  relocated operations to Houston. Moving, loss of
  income coverage 100,000.

18
Insurance

• Find out what records your insurance provider
  will want to see after an emergency and store
  them in a safe place
• Keep a copy of your insurance policy/policies
  offsite and include a checklist for insurance
  coverage in place and a form to record insurance
  policy information
• Understand what each policy covers and what it
  does not

19
Insurance Things to think about

• Standard Commercial Property Insurance policies
  cover fire and theft on premise. Various
  provisions restrict coverage in insurance
  policies. Read the entire policy carefully to
  determine your rights, duties and what is and is
  not covered.

20
Insurance Things to think about

• HME providers equipment that is out in patients
  homes is not usually covered under a Standard
  Commercial Property policy unless an Equipment
  Off Premise endorsement is purchased. Equipment
  off premise provides limited protection for
  insured property while temporarily at a location
  not owned, leased or operated by the insured.

21
Equipment Off Premise Inland Marine

• Depending on the area, some insurance companies
  include the endorsement within the property
  policy
• Some companies will not write the endorsement in
  flood plains
• Check with your agent!

22
Perils normally excluded from Standard Policies

• Flood 75 of disaster declarations result from
  natural phenomena in which flooding was a major
  component. If you are unsure, you can find out if
  you live/operate in a flood prone area from your
  state emergency management office or Red Cross
  chapter

23
Perils normally excluded from Standard Policies

• Individuals and business owners can protect
  themselves from flood losses by purchasing flood
  insurance through the National Flood Insurance
  Program (there is normally a thirty day waiting
  period before a new policy becomes effective).
  Most commercial property policies exclude flood.

24
Dont Under-insure

• Review your buildings and contents coverage
• Penalties were applied to many HME providers
  affected by the disaster for under-insuring.
  Generally, most policies required the providers
  to purchase property coverage at 80 of
  in-house assets (inventory, furniture,
  fixtures, office equipment, etc).

25
Other Perils

• Earthquake Coverage for earthquake damage is
  excluded in most property insurance policies. If
  you are located in an earthquake-prone area,
  youll need a special insurance policy or
  commercial property earthquake endorsement
• Wind/Hail Coverage for wind and hail is
  typically excluded in the coastal regions. If
  coverage exists, usually a deductable applies
  this will be explained in your policy wording.

26
Conclusion

• Every policy has different variations of coverage
• Get educated regarding your insurance policies.
  Dont wait to find out if you are adequately
  coveredit may be too late!
• John Spragle, President, VGM Insurance
• Read your Dec (declaration) Page! If you dont
  understand whats covered and what isnt, call
  your agent!

27

• 2 Ongoing Operations

28
Triage of Critical Patients

• Of course, one of the most important functions of
  the HME recovery process is providing ongoing
  care to your critical patients
• Identifying these patients by category (e.g.,
  patients on ventilators, mobility challenged
  patients, oxygen patients) should be done before
  an emergency happens.

29

• In a follow up with HME providers, virtually 100
  of them maintained patient lists, which included
  emergency contact, diagnosis, physician/contact
  information, HME equipment, settings and back-up
  equipment information.
• However, less than half were up to datemany
  inaccuracies especially in current addresses were
  noted.

30

• As you identify patients by diagnosis category,
  you need to assess what resources you need to
  have to provide ongoing support. Also, it is
  important where these resources are. Perhaps the
  most important is

31
Your Gas Supplier

• Ensure that your oxygen supplier has a generator!
• Have emergency numbers to contact them (cell
  phone, pager, answering service, home numbers).

32
From a VGM member

• This saved us because cell phones, answering
  services and pagers were done. I was able to
  reach the General Manager at his home. He was
  able to contact his employees to help us with
  liquid base units. In our case, our gas supplier
  did not have a generator and could not transfill.
  He did give us all of his liquid base units and
  H cylinders (used as backups). An H cylinder
  full lasts approximately 57 hours on 2 liters.

33
Have a backup gas supplier

• Ensure that the backup supplier has a generator
  and will come to your aid in a crisis situation.
• From another member I happened to know a
  supplier in our area and he was ready if we
  needed him. It is very important to requote your
  business when your contract is up. You truly do
  make contacts and during a crisis this will
  separate the best from the average companies.

34
Generator

• Ensure your generator can power your facility.
• We had lights and phones within 1-2 minutes
  after the blackout. This saved us because our
  answering service could not handle our calls. We
  ended up spending the night to ensure our
  patients were taken care of.

35
Generator

• Even though your HME has a generator, it may not
  power your computer (e.g., surges, etc). Have a
  current hard-copy list of oxygen patients, and
  prioritize contacting those patients without
  backup oxygen cylinders.

36
Gasoline Supplier

• Ensure that your gas supplier can manually pump
  gasoline.
• Many diesel suppliers will be OK, but most HME
  vans run on gas.

37
New Policies

• All trucks must fill up at then end of the day
  (versus in the morning)
• Locate a gas station that can manually pump gas
  in an emergency
• Contact the city that your company resides in,
  trucking firms, oxygen suppliers, apartment
  complexes and see if they have a gas pump on the
  site that you could utilize during an emergency.

38
Miscellaneous

• Bottled water and snacks on site for your staff
• Flash lights
• Extension cords
• From another member Most importantly, have
  someone in charge that can direct and keep people
  calm. It was truly a challenge when it was not
  long after 911 and without notice our
  communication to the world stopped. Someone
  needs to take control and have a calming affect
  until you really know what you are dealing with.

39
Billing Capability

• An HMEs ability to continue as an ongoing
  business is usually contingent upon the ability
  to bill Medicare and other payer sources.
• As part of your planning process you must
  evaluate how youre going to continue billing in
  the event of a disaster.

40

• We found that HMEs using Internet based billing
  systems or billing services were better prepared
  to continue billing.
• What percentage of members of audience use
  Internet-based systems? Outside billing
  services. Input on advantages or disadvantages?

41
Billing Capability

• CMS has created the following new condition codes
  and modifier (effective 8/12/2005) DR
  (Disaster Related) and CR (Catastrophe/Disaster
  Related).
• For more detailed billing information and FAQs go
  to http//www.hmehurricane.com/

42
Payroll

• Payroll continuity is key to continued loyalty of
  your employees, so make sure your planning
  addresses your on-going ability to pay employees.
  It helps them handle disaster-related problems
  at home and meet their personal financial
  obligations.

43
Disaster Bonus

• At the time we did not have a bonus structure in
  place for emergencies. Our employees rose to the
  occasion. I was extremely proud of them for
  going above and beyond. After the blackout, we
  instituted a bonus plan and paid employees a
  bonus. We had a luncheon meeting and presented
  all employees with the bonus. It went over so
  well. I really have to say it was one of the
  most moving moments for me. These people love
  and care for our patients. We even serviced
  patients that were not ours, just because we are
  who we are.

44
3 Internal ExternalCommunications/Public
Relations
45
Internal Communication

• One of your most valuable assets is your
  employees. In the event a disaster occurs, you
  need to protect yourself and your staff. You
  also have to consider the possible impact a
  disaster will have on your employees ability or
  desire to return to work.

46
Advanced Planning Steps

• Create and maintain an employee contact list with
  current address and phone numbers for each person
  on staff.
• Create a calling tree. Use your employees
  contact list to fill out a calling tree.
  Maintain and keep this in an accessible location.
  Also make sure a copy is offsite. The person
  designated as primary on the tree should be the
  one responsible for the tree and for calls by
  fellow employees.

47
Actual Scenario

• Virtually 100 of HME providers had developed
  call tree procedures. Copies were in offices,
  vans, homes, on-call vehicles, etc.
• When asked the last time the calling tree
  procedure was tested, responses ranged from
  never..we made one for JACHO, to a few months
  ago.
• Select a day in the near future and TEST!

48
Transportation and Housing

• Have you considered the need for alternative
  forms of transportation for employees? Rental
  vehicles?
• You need to be prepared if a disaster occurs and
  your employees dont want to return to the area.
  You may need to consider issues such as
  alternative housing options and ways to replace
  the knowledge base lost if employees dont return
  to work.

49

• Store a hard copy of your vital information such
  as your employee data and payroll in a fire-proof
  box off-site. Some experts recommend at least 50
  miles away. Make it a critical part of your
  routine to regularly back up your personnel and
  payroll files
• More companies are using internet based back up
  companies who routinely back up critical
  information. Then the information is readily
  available from any internet ready source.

50
External Communication

• Planning is required so that when a disaster or
  emergency occurs, inquiries from the news media,
  patients, referral sources and staff can be
  handled effectively. It is easier to compose
  communications in advance, with time to think,
  than it is in the face of a crisis.

51

• In our follow-up, we asked HME providers what
  they would have done differently with regard to
  external communications and suggestions for
  advance planning. They replied.

52

• Identify a Spokesperson. Within the HME
  communication team, there should be an individual
  who is authorized to speak for the company. That
  person should be an effective communicator.
• Anticipate and prepare universal talking points.
  You need to make sure the facts presented to the
  public are accurate and positive. Be proactive
  and prepared for a crisis. Hold a Communication
  Team meeting and identify possible crises that
  can occur. Think in advance about canned
  responses to different situations.

53

• This is a good example
• We have implemented our crisis plan, which
  places high priority on our patients and
  employees. For additional information we can be
  contacted at
• Always make sure contact information is included.
  Your patients, employees, referral sources, etc,
  need to know how to contact you. You cannot tell
  them too often during a time of crisis.

54

• To Do List Prepare an updated external key
  contact list! You will need to develop a list of
  key contacts who may be critical to the operation
  of your business.

55
Special Web Sites

• Activated in time of crisis (or as a follow-up to
  an emergency situation) with the purpose to keep
  patients informed.
• Toll free emergency call in numbers, contact
  information, FAQs with regard to equipment, etc
• Other appropriate information
• Discuss with your web hosting/development company

56
4 Data Protection Recovery andDocument
Retention
57
Data Protection and Recovery

• In this electronic-age, you rely more than ever
  on your computers to supply you with the
  information you need. Chances are every piece of
  data you might ever rely on to make an important
  decision has been reduced to a digital format and
  resides somewhere on a computer hard drive.

58

• Improved functionality and productivity are the
  benefits of technology, however on the flipside,
  one wrong click, one nasty virus, one untimely
  power surge, one unhappy employee or one natural
  disaster and that data can be gone forever!

59
Data Back-Up

• Having hard copies of data important to your
  company is crucial to recovery. Data is located
  in many places throughout your business, even if
  you are computerized. Use the Data Backup
  Worksheet to help you identify what data you need
  and determine if its backed up and where. Then
  use the Risk Assessment worksheet. These two
  worksheets will help you determine where your
  data backups need to reside for the greatest
  level of protection for your business.

60

• Many disaster providers wished they had
  subscribed to a business data storage/replication
  service.
• All agreed that storage some place outside of the
  HME facility offered the best protection.
• On-line backup services are a good choice with
  reasonable costs.

61
Test your backups!!!!!

• You need to make sure that your backup process is
  working before you need it. A simple way to test
  the effectiveness of your backup procedures is to
  create a test file that is backed up during your
  normal backup process. Delete this file from
  your computer and attempt a restore from your
  backup media. We suggest doing this at least
  twice a year.

62
Keep a current list of hardware and software

• Actual Scenario This helped us with our
  insurance claim and aided in replacing the
  computer equipment.
• Make sure this list includes the hardware for the
  tape or disk backup method you use.
• See the Essential Equipment worksheet.

63
Document Retention

• As you are well aware, certain documents are
  extremely important to an HME business, including
  patient medical records and CMNs. In the
  planning process you must consider how you would
  deal with the potential loss of these important
  documents. Consider the purchase of scanning
  capabilities to image patient CMNs and other
  papers that are crucial to your business.

64
5 HME Physical Plant
65
Advance Planning Steps

• Contact Information. Make sure a list of all
  contact information for utilities, contractors,
  building maintenance, any company that is
  involved in physical building is kept offsite.
• Included in this list will be all account
  numbers, any contractual information or any other
  pertinent information. Make sure you also have a
  telephone list for all employees that would be
  involved with fire, police and emergency
  personnel.

66
Advance Planning Steps

• Setup Building Safe Area. Identify safe areas in
  building if disaster occurs during business
  hours.
• Identify these areas with appropriate signage,
  e.g., Tornado Shelter
• In case of fire, designate an area outside the
  building where employees should meet. If
  building is unavailable, have predetermined
  location for personnel to meet after a disaster.
  Have two alternates, just in case disaster is
  wide spread.

67
Advance Planning Steps

• Office Equipment Inventory. Keep an inventory of
  all office equipment, copiers, office machines,
  desks, chairs, fixtures, etc, and whether you own
  or lease.
• You should explore rental options to replace
  damaged equipment during the time it is being
  repaired or replaced and request written
  estimates of rental, set-up, shipping costs and
  delivery times. This is particularly important
  if you rely on equipment that is highly
  specialized or difficult to replace. Be sure to
  add the rental companies you have contacted to
  your Suppliers/Vendors form.

68
Advanced Planning Steps

• Transportation Needs. Dont forget your
  cars/delivery vans. Plan to protect them, but
  also have alternate plans to meet your essential
  transportation needs.
• Essential Equipment List. After a disaster a
  building might not be entered for more than a few
  minutes. Have predetermined list of critical
  items (if salvageable) that you would need to
  retrieve. Items such as computers, computer
  disks, certain paper files and work in progress.

69
6 Phones and Internet
70
Advance Planning

• Determining how your patients, referral sources
  and employees reach you during an incident is
  critical. Whether it is by voice, email, fax or
  snail mail, you need to pre-plan how you will be
  contacted!

71
Advance Planning

• Arrange for programmable call forwarding for your
  main business number.
• If you cannot physically access your business,
  you can call into your local phone service
  provider and have the calls to your local phone
  number reprogrammed to ring elsewhere.

72
Advance Planning

• Consider alternative forms of communications.
  Should your phone system not be working, it is
  necessary to keep in touch with your employees
  and patients. In anticipation of a break in all
  phone service, including cell phones, some
  alternatives would be simple two-way radios,
  satellite phones and pagers that send signals to
  each other.

73
Actual Scenarios from HME providers

• Many communicated by email.
• Those with websites posted an emergency messaging
  system after power was restored.
• Check with your answering service to arrange a
  voicemail box that can record messages for your
  employees. They can then check this one location
  for information on the business.

74
More Advanced Planning

• Recovery Location. As you think about your voice
  communication needs at your recovery location,
  determine whether you will need speakerphones,
  voice mail capacity or the ability to record
  conversations. Also decide if you will need
  conference calling capability in order to have
  conference calls with employees, key contacts
  and/or patients to assess disaster damage and to
  make recovery decisions.

75
Actual Scenario

• During a power failure, the HME telephone system
  did not work since it relied on external power.

76
Suggestions

• If your fax machine is directly connected to a
  telephone line, you should be able to plug a
  plain telephone into the connection the fax uses
  and make phone calls. This is because the local
  phone company has extensive back up power.
• Consider purchasing back-up Plain Old Telephone
  sets(very inexpensive!)

77
Importance Communications Records(Keep Offsite)
To Do..

• Local phone service-get Customer Service
  Record, all contact information, discuss
  emergency options
• Answering service-get contact information ask
  what services they offer
• Telephone system-updated inventory list, contact
  info, replacement procedures discussed
• Long distance-contact info, ask to repoint your
  toll-free to answering service or alternative

78

• And, most importantly

79
Assign Accountability!!!

• It is essential that senior leadership of the HME
  organization sponsors and takes responsibility
  for creating, maintaining, testing and
  implementing these steps. This will insure that
  management and staff at all levels understand
  that preparedness is a critical top management
  priority.

80
Then.

• TEST
• TEST
• TEST
• TEST
• TEST

81
Update Pandemic??

• The fact of the matter is, when it comes to
  pandemics, we are overdue and we are
  under-prepared, warned U.S. Health and Human
  Services Secretary Mike Leavitt at a forum at the
  National Press Club in Washington D.C.

82

• HHSs Home Health Care Services Pandemic
  Influenza Planning Checklist is now available!
• Go to
• http//www.pandemicflu.gov/plan/healthcare.html
• Please download, review and complete this
  document carefully!

83
Establish policies to be implemented during a
pandemic

• Establish policies for employee compensation and
  sick-leave absences unique to a pandemic (e.g.
  non-punitive, liberal leave), including policies
  on when a previously ill person is no longer
  infectious and can return to work after illness.
• Establish policies for flexible worksite (e.g.
  telecommuting) and flexible work hours (e.g.
  staggered shifts).
• Establish policies for preventing influenza
  spread at the worksite e.g., promoting
  respiratory hygiene/cough etiquette, and prompt
  exclusion of people with influenza systems.

84
More policies.

• Establish policies for employees who have been
  exposed to pandemic influenza, are suspected to
  be ill or become ill at the worksite (e.g.
  infection control response, immediate mandatory
  sick leave).
• Establish policies for restricting travel to
  affected geographic areas, evacuating employees
  working in or near an affected area when an
  outbreak begins, and guidance for employees
  returning from affected areas (refer to CDC
  travel recommendations).

85
One more.

• Set up authorities, triggers and procedures for
  activating and terminating the companys response
  plan, altering business operations (e.g. shutting
  down operations in affected areas), and
  transferring business knowledge to key employees.

86
Additional Resources

• US Department of Homeland Security
• www.ready.gov
• Federal Emergency Management Agency
• www.fema.gov
• International Risk Management Institute
• www.irmi.com
• VGM Insurance
• www.vgminsurance.com
• VGM Technologies
• www.vgmt.com

87
Other possible resources

• Your State Association
• www.mhha.org
• State and/or local government
• Department of Public Health