As more organizations shift to using an electronic medical record, the value of disaster preparedness for information technology lies not only in the data, but increasingly, in the ability to provide basic client care. Most of those responsible for IT realize quickly the need to have all of the data backed up in case of a system failure. Unfortunately, the existence of backup tapes might lead to a false sense of security. Preparing for a disaster goes far beyond this basic step. Ironically, backup tapes are often kept in the server room, with the servers. Sometimes they’re kept in the IT manager’s desk. 
We know, of course, that these tapes must be kept in a fireproof and heat-resistant container, but what about the program that produces the data? Would that be transferable to another server and would we be able to ensure that client care will not be interrupted? 

These types of considerations are usually addressed in a formal plan. Most facilities are required to have an Emergency Preparedness Plan. The ones with which I’m most familiar are under the auspices of ESDA (Emergency Services and Disaster Agency), which is responsible for municipalities. Most organizations have similar (if not identical) methods and requirements for disaster preparedness. (Joint Commission on Accreditation for Health Care Organizations requires it.)
A typical preparedness plan consists of a large three-ring binder spelling out the policies and procedures to be followed in the event of a disaster. Most people find it easy to file this knowledge away in their brain under the term, “Do not bother to remember this, unless it’s REALLY important.” And then they promptly forget it. These plans are derisively referred to as suffering from “paper-plan syndrome.” They give the impression that a disaster plan can fully anticipate an unfortunate event.

Failure to imagine disaster

As most of us will acknowledge, the greatest failure on 9-11 wasn’t inadequate preparation, rather, it was failure to even imagine that such a thing could occur so we couldn’t be adequately prepared. “Failure of The Imagination” happens to everyone at some point and a preparedness plan that fails to take into account this uncertainty about the future runs the risk of being useless. Yet, buried somewhere within that three-ring binder is valuable information in the form of a call tree, a directory of important contact telephone numbers, the chain of command and some type of interagency agreements.

These are the heart of a well-thought out plan. Organizations that acknowledge they can’t anticipate every type of disaster are the ones that are truly prepared. They condense the huge binder into a small pamphlet that everyone can easily remember and use. The voluminous policy and procedures, while they may be essential, won’t prevent and address the problems associated with an event.  If they don’t know what to do, employees will do what comes “naturally.” This probably isn’t the best way to be prepared.

Before you call your HR Manager or whoever is responsible for disaster preparedness and tell them what you think of their three-ring binder, keep in mind that there is nothing wrong with this sort of planning, unless it’s the only sort of planning. There are some events that are much more likely to happen than others, and having some basic information set aside for those scenarios is important. It is equally important, though, to recognize the uncertainties surrounding any event that has yet to occur, and to develop a resilient framework for addressing them.

Mitigation and preparedness

A disaster plan should have two purposes: mitigation and preparedness. Preparedness consists of the classic approach taken where potential events are scripted; policies developed; and checklists derived to reduce an organization’s vulnerability or intensity of an event. Mitigation makes potential disasters much less likely to occur in the first place, or at least, includes ways to make them less destructive. Neither approach, alone, can effectively address the preparedness needs of a facility.

Preparedness might mean having specific locations designated as shelters, whereas mitigation would mean regular training of first responders. Organizations that address both modalities of disaster planning help their organization to anticipate events that could happen and build resilience into their staff and systems so they can respond to the unpredictable demands of a disaster.

To respond more effectively to disasters many agencies have adopted a method known as the “Incident Command Structure” or ICS. ICS was originally developed during the 1970s to facilitate responses to wildfires. It has since been adapted for use across all emergency management agencies including the Federal Emergency Management Agency (FEMA), The Department of Homeland Security, and many others. The value of this structure is that it is highly flexible to the demands of the specific disaster, improves communication among those who must respond, and coordinates efforts to make them more effective.

Under this type of system, the first one on a scene becomes the commander until the initial scene is resolved or until charge of the scene has been transferred to someone better equipped to address it. Control of the overall situation is handled by an incident response team in a central location, which includes individuals representing numerous departments and/or agencies.

These individuals have been trained in advance using the same terminology and standard methods of addressing disasters. Using the ICS philosophy, the most effective Disaster Preparedness Plans are:

• Comprehensive: Addressing a wide variety of potential problems.
• Simple: Using standard procedures easy to understand by everyone.
• Flexible: Able to adapt to a wide range of problems through individual initiative and thorough training in advance of the disaster.
• Command Structure: Responsibility for decisions is clearly defined.

With regard to Information Technology, a good preparedness plan will involve prevention of problems in the form of tape backups, stored securely onsite, or better yet, stored securely at another location. It will involve fire suppression systems and robust environmental controls. A good plan also will involve mitigation strategies that train IT staff to realize the crucial importance of the server data, and the need to ensure continuity of care. It should ensure that there is always someone who knows it is their responsibility to secure information technology. This includes considerations for moving care to a different physical location, even to ways to provide accessibility to certain care information without electricity. 

When systems fail, they should fail gracefully;,in such a way that backup and alternate systems can resume normal operations. A mitigation strategy that places a greater emphasis on the ability of staff to adapt will be more successful than a mountain of checklists and three-ring binders.

References

Planning for Resilience in Hospital Internal Disasters, Ernest Sternberg, Prehospital and Disaster Medicine, (http://pdm.medicine.wisc.edu)
Hospital Disaster Plans and the Incident Command System, Keith Conover, MD, Mercy Hospital.

Comments

Add New Search RSS

Write comment
Name:
Email:	do not notifynotify
Title:
	Please input the anti-spam code that you can read in the image.

Powered by !JoomlaComment 3.26

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."