Section 6.12 Optimize

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE- 1

Contingency Plan Assessment for EHR and HIE

Use this tool to identify and document all existing backup functions, emergency mode operations, and disaster recovery plans in existence, and to plan for enhancements as health information technologies (HIT) systems are adopted.

Time needed: 16 hoursSuggested other tools: Section 1.4 EHR Technology and Readiness Inventory, Section 1.5 HIE Technology Readiness Inventory

Introduction Disaster recovery refers to the ability to recover data after a disaster or other interruption of service. You can use the contingency plan assessment to assess your current contingency plans and to prepare for enhancements as more mission critical clinical information systems are adopted and replace paper-based systems.

How to Use1. The person responsible for contingency planning should complete this form, in conjunction with the (HIT) steering committee. The HIT steering committee needs to be involved in determining the criticality of IT resources, data, and applications. Some home health agencies may utilize companies that specialize in emergency mode operations/disaster recovery planning to develop, test, and maintain such plans for the physical facility, such as for fire safety. These plans should be enhanced with backup and business continuity/disaster recovery plans for disruption to HIT.

2. If you do not have physical facility contingency plans, it is critical to assess your HIT contingency planning needs.

3. If your agency will have its servers hosted offsite, you may just need business continuity plans for reverting to paper and manual processes in the event of system downtime, loss or failure of an input device, lack of connectivity, or power outage. If your agency will manage its own data center, a more robust plan for backup and disaster recovery is needed in addition to business continuity planning.

4. Complete each of the sections of this tool in sequence, reflecting the current situation at your home health agency.

5. As your data criticality changes with electronic health records (EHR) and participation in a health information exchange organization (HIO), evaluate your changing needs. For example, you may currently back up once a day and have an employee take the backup to the bank’s safe deposit vault. Once you move to an EHR, you will need fully redundant servers, network capability, and simultaneous backup. These can be acquired through an information systems host, application service provider, or software as a service vendor (see Section 1.9 Financial Assessment, Financing Resources, and Acquisition Models), but there may still be additional costs for other forms of redundancy, such as for telecommunications/connectivity, input devices, and power. Be

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE - 2

sure these requirements are brought forward as you work on your total cost of ownership and return on investment planning (see Section 2.11 Business Case: Total Cost of Ownership and Return on Investment for EHR and HIE.)

Criticality AnalysisUse the following definitions to describe Criticality Level:

• For IT Resources:o Remote and fully redundant (with automatic failover and sustainable

power)o Local and fully redundant (with automatic failover and sustainable

power)o Redundant (without automatic failover)o Backup only (with specified lag time during which data may be lost)

• For Applications:o Mission critical (impacts patients)o Critical (impacts productivity)o Important (manual workarounds suffice)o Deferrable (minimal impact)

• For Data:o Private/Sensitive (disclosure adversely impacts patients)o Confidential (wrongful disclosure has potential to harm individuals or

the organization)o Proprietary (disclosure of business/practice secrets may result in loss

of competitive advantage)o Public (no harm through disclosure)

Current State Description Criticality Level

Planned StateCriticality Level

Planned Remediation

IT Resources

Production server(s)

Test server(s)

Back up server(s)

Exchange server(s)

Other:

Input devices

Printers

Scanners

Other:

Telecommunications devices

Telecommunications media

Telecommunications provider (e.g., telephone company for Trunk Line)

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE - 3

Internet service provider

Other:

Power

HVAC

Fire prevention & suppression

Other:

Applications

Data (e.g., client protected health information, facility budget, human resource information/salary and benefits data)

Other:

Copyright © 2014, Margret\A Consulting, LLC. Used with permission of author.

Data Backup PlanRecord the following backup information, as applicable, for data, application software, operating systems, and hardware (use additional rows as needed):

Frequency may be continual, on schedule (specify schedule), or periodic. Method may be full, incremental, or partial/differential (other terms may

apply, such as “image” for a server). Media are the devices on which the backups are stored and may include a

storage area network, network attached storage, RAID, external disk drive, internal disk drive, or other device.

File Naming refers to the versioning process to ensure effective and efficient retrieval.

Media Rotation refers to the process used to reuse media, if applicable. Location refers to where the backups are stored (both temporarily and

permanently). Transport refers to how the backups get moved to their permanent storage

locations (e.g., electronic transmission, bonded courier company, staff member private automobile).

SLA is presence of a service level agreement if backup is performed by and/or transported and stored by a third party.

Recovery refers to the method by which the asset would be restored/replaced.

Testing refers to whether there is a routine or ad hoc testing schedule. Organizations may wish to record testing dates and results.

Frequency Method Media File Naming

Media Rotation

Location Transport SLA Recovery Testing

Data

Application

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE - 4

Software

Operating Systems

Hardware

Copyright © 2014, Margret\A Consulting, LLC. Used with permission of author.

Emergency Mode Operation and Disaster Recovery PlanThe following is an outline of the contents of an emergency mode operation/disaster recovery plan. Use this to check the documentation and processes that exist in your organization and identify those that are missing.

Plan Components Description Present?

Introduction Purpose Applicability Scope/Assumptions Development Maintenance Testing Record of Changes References/Requirements

Organization Steering Committee Management Team Support Teams

Operations IT Resources Description and Architecture Application Description and Architecture Data Description and Architecture

Notification and Activation Damage Assessment Response

• Deployment of Teams• Notification to Alternative Site• Procurement of Resources

Dissemination of Public Information

Recovery Operations Recovery Procedures• Emergency Phase • Backup Phase • Recovery Phase

Return to Normal Operations

Concurrent Processing Plan Deactivation

Appendices Personnel Contact List Vendor Contact List Notification List Equipment and Specifications Service Level Agreements or Memoranda of Understanding Information Technology Standard Operating Procedures

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE - 5

Criticality Analysis Related Plans

• Related Contingency Plans for Patient Care• Emergency Management Plan• Occupant Evaluation Plan• Continuity of Operations Plan

Copyright © 2014, Margret\A Consulting, LLC. Used with permission of author.

Copyright © 2013 Updated 11-20-13

Section 6 Optimize—Contingency Plan Assessment for EHR and HIE - 6