Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
“When Disaster Strikes: Keys To A Sound Business Continuity Plan”
A Complimentary Webinar From healthsystemCIO.com
Sponsored by Iron Mountain
Your Line Will Be Silent Until Our Event Begins
Thank You!
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Housekeeping
• Moderator – Anthony Guerra, editor-in-chief, healthsystemCIO.com
• Ask A Question• We will be holding a Q&A session after the formal presentations. • You may submit your questions at any time by clicking on the QA panel located in the
lower right corner of your screen, type in your questions in the text field and hit send. Please keep the send to default as “All Panelists.”
• Download the Deck • Go to: http://healthsystemcio.com/presentation/disaster-recovery-webinar.pdf• Shortened link below appears on most slides.
• View the Archive• You will receive an email when our archive recording is ready. • Separate registration is required.
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Agenda — 45 Minutes
• 20 minutes: John Bosco, SVP/CIO, North Shore LIJ Health System
• 5 minutes: A Word From Our Sponsor: Michael Leonard, Director of Product Management, Healthcare IT, Iron Mountain
• 20 minutes: Q&A w/John Bosco
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
“When Disaster Strikes: Keys To A Sound Business Continuity Plan”
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 9915
Keys To A Sound Business Continuity Plan
Agenda
• Overview of the Health System• Hurricane Sandy
• Impact• What We Did Well• Challenges• Lessons Learned
• Business Continuity vs. Disaster Recovery Planning• IT Business Continuity Plan• BCP in our Ambulatory Setting
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
North Shore-LIJ Health System At-A-Glance
Key Facts:
• 17 Hospitals (6,000+ hospital and long-term care beds)*
• Owner/operator of North Shore-LIJ CareConnect Insurance Company, Inc
• 3 Skilled Nursing Facilities
• Nearly 400 ambulatory and physician practices
6
*Does not include affiliate organizations
• Nation’s 14th largest healthcare system, based on net patient revenue, and the largest in New York State
• Service area of 7 million people in Long Island, Manhattan, Queens and Staten Island
• Nation’s seventh-largest physician group practice with nearly 2,600 full-time physicians in the North Shore-LIJ Medical Group
• Home of the largest “corporate university” in the healthcare industry – the Center for Learning and Innovation SM
• Home of the nation’s largest patient simulation center – the Patient Safety Institute SM
• Nursing school affiliation with 37 colleges and universities
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Major Health SystemEmergency Preparedness Events
8
• 1999 – Y2K; Hurricane Floyd
• 2001 – September 11th; Anthrax
• 2003 – Northeast Blackout
• 2003 – SARS Outbreak
• 2005 – NYC Transit Strike
• 2009 – Pandemic H1N1 Outbreak
• 2010 – Christmas Blizzards
• 2011 – Hurricane Irene
• 2012 – Hurricane Sandy
• 2013 – Northeast Winter Storms
8
Events of the past 15 years have significantly increased the need for concise attention to emergency preparedness
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 9919
“Hurricane Sandy was the worst storm to hit our region in over 70 years. An historic event of such magnitude requires an historic response. The ability of our employees and clinicians to keep our doors open, meet community needs during a crisis and assist other hospitals in distress was a significant achievement.”
North Shore-LIJ President and CEOMichael Dowling
Hurricane Sandy
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Hurricane Sandy – Key Points• System Emergency Operations Center (EOC) officially activated Monday, Oct 22, 2012
• Rapid assessment and discharge occurred prior to the hurricane, approximately 2,391 patients discharged from Friday, Oct 26th – Sunday, Oct 28th
• Modified evacuation of Staten Island University Hospital and Southside Hospital: Oct 26th –Oct 27th
• All facilities remained fully operational, including 3 facilities in flood zones
• Several hundred nursing home patients from 10 different facilities in the Rockaways and Long Beach were accepted and transported by NSLIJ
• NSLIJ received a total of 139 patients from NYU Medical Center, Bellevue Hospital, and Coney Island Hospital
• NSLIJ System EOC facilitated NY and Nassau County OEM’s request for the accommodation of dialysis and psych patients from the Rockaways, South Nassau, and Bellevue Hospital
• A large number of the worried-well presented at North Shore-LIJ hospitals
• Assisted with municipal special need shelters and general population shelters
• Operated NSLIJ fueling stations and transportation alternatives for health system employees
• Created the Employee Assistance Resource Center for Health System employees who suffered catastrophic damages from the storm
10
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99111
• Proactively shut down one of the satellite Data Centers due to the proximity to the water which came within 6” of being flooded.
• Sporadic network connectivity issues between hospitals and the primary Data Centers.
• Inability for IT staff to get to work locations due to gas shortage, power outages and blocked roadways.
• Data Centers and hospitals on generator power.
Hurricane Sandy – IT Impact
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99112
• Activated HEICS across the enterprise.• Communicated safety information throughout the organization via multiple
communication methods.• Identified support teams with 24/7 staffing plans.• Placed DR service providers and vendors on alert.• Conducted daily briefings with leadership.• Met with vendors to review their contingency plans and arranged for additional
coverage.• Activated Technology and Disaster Recovery Command Centers and staffed around
the clock throughout the week of the storm.• Fueled and tested Data Center generators.• Deployed IT Staff to all hospitals.• Arranged fuel, water, food and lodging for staff.
Hurricane Sandy – What We Did Well (IT Planning)
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99113
• Maintained ongoing communications with EMS.• Conducted hourly Technical Health Checks
(status of all telecom, major infrastructure and facilities).
• Opened IT conference bridges for continuous communications.
• Held scheduled Leadership Status Briefings.
Hurricane Sandy – What We Did Well (IT Execution)
• Tracked and escalated all issues, as appropriate.• Maintained ongoing communications with vendors.• Drafted options for re-powering and possibly relocating the Staten Island
Data Center systems to an alternate site.• Activated Work Remote support plans.• Tracked staff and provided employee assistance, as appropriate.
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99114
• Blocked and flooded roadways prevented staff from getting to their primary work locations.
• Lengthy power outages in residential areas did not allow some staff to work remotely.
• Sporadic phone and network communications prevented hospitals from accessing key clinical care systems/data and hampered phone communications amongst staff.
Hurricane Sandy – Challenges
• Gas shortage prolonged staff’s ability to commute to their primary work location.
• Inability to access transferred patients electronic medical record information.
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99115
• Utilize RHIO for patient chart information for disabled hospitals• Update inventory of laptops and network gear to rapidly stand-up critical departments in new
locations.• Move satellite Data Centers out of flood zones.• Enhance technology resiliency and network redundancy standards. • Enhance IT communication capabilities through the use of a two-way emergency and incident
notification system.• Enhance “work remote” capabilities to accommodate possible gas shortage and prolonged
power outages at primary work locations.• Replace critical offsite tape storage with virtual tape library and data replication technologies to
minimize reliance on tape delivery to recovery site.• Provision additional emergency power generators at the Data Centers.• Formalize Business Continuity Plans for IT Service Delivery and Operational Support areas.• Train additional staff in FEMA Incident Command System (ICS) principles and procedures.
Hurricane Sandy – IT Lessons Learned
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
• Business Continuity is the ability of a business to continue its operations with minimal disruption or downtime in the event of natural or intentional disasters.
• Business Continuity Planning (BCP) is a structured program to ensure business survival by planning for reasonably foreseeable business interruptions and by taking appropriate, cost justifiable actions.
• Disaster Recovery Planning (DRP) is the advanced planning to prepare for recovery or continuation of the vital technology infrastructure in the event of a catastrophic event or significant system outage.
Business Continuity
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99117
General preparatory activities performed by IT included ongoing review and maintenance of:
IT Level Prep - General
• Event and crisis communication procedures
• Staff relocation strategies• Disaster Recovery Plan activation and
declaration procedures• System (application) recovery strategies
and restoration plans• Change management and project
lifecycle reviews• Facility resiliency assessments of
primary work locations
• Response roles/responsibilities, processes and procedures
• Escalation processes and communication protocols
• Notification and team mobilization procedures
• Remote IT Staff system and data access requirements
• Critical support functions, key applications, software, process dependencies, vendors, infrastructure and vital record requirements
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Maintain Business Continuity by Staying Ahead of Disasters
96-Hours Prior to Event 72-Hours Prior to Event 48-Hours Prior to Event 24-Hours Prior to Event
Planning Team MeetPlanning Team & Incident Command Team Meet
Vendor Preparation & IncidentsPlanning Team & Incident Command Team Meet
Data Center Checklist Lodging & Logistics DeterminationPlanning Team & Incident Command Team Meet
Begin 12 Hour Staffing Plan Rotation
Help Desk Checklist Off Site Data Plan Lodging & Logistics Plan Set up Lodging/Staging Area
Infrastructure Checklist Management & Staffing PlanStaff Communication and All Employee Call
Staff Communication and All Employee Call
Application Checklist Staff Communications Plan Assemble IS Command CenterAssemble Hospital Command Centers
Disaster Recovery Review Logistics Planning Team Prep
Incident Command Structure Assemble System Command Center
Lodging & Logistics Planning Team Checklists
*This will be adjusted based on severity of the event and length of advanced notice
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Core Elements of A Business Continuity Plan
• Enterprise Command Structure which includes a Command Center comprised of senior management to track and communicate status and manage recovery efforts
• Business Impact Analysis to identify core business functions, services, dependencies and priorities
• Data Backup and Recovery Plan to ensure systems and data can be restored at an offsite location
• Documented Procedures which enable critical business functions and services to be continued if systems or facilities are unavailable
• Alternate Communication Methods which provide emergency notification and incident response services to personnel
• Alternate Physical Location for personnel in the event of a business interruption that affects the availability of a primary physical location
Business Continuity Plans must be regularly reviewed and tested
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
• Scenario-Based Planning—Allows the organization to remain focused on the response effort.
Scenario 1: Key Data Application Unavailable
Scenario 2: Network Connectivity Lost
Scenario 3: Building System Unavailable
Scenario 4: Key Vendor(s) Unavailable
Scenario 5: Personnel/Staff Unavailable
Source: Cole G & Barnes AC (May/June 2005). The Business Continuity Planning Initiative at Johns Hopkins Health System. Continuity Insights: 32-40.
Developing the Ambulatory BCP
21
5
4
3
2
1
Severe Enterprise Wide Impact
Enterprise Wide Impact
Regional/Geographic Impact
Practice/Building Impact
Alert/Awareness
Seve
rity
Each level has defined actions and considerations for Ambulatory, Service Lines, and Practices
Ambulatory Activation Levels
22
Evaluate Facility1Complete
‘Amb Svcs Post Disaster Recovery Checklist’(Safe to Occupancy?)
Send completed report to A/S EOC*IF SAFE TO OCCUPY, APPROVAL TO PROCEED
TO STAGE 2IF NOT MOVE WILL BE MOVED TO STAGE 3*
Evaluate Staff2
(Available to Work?)
Confirm Available MDs
Confirm Available Staff
Establish Contingency (If
needed)
3
Issue: Power/Safety (Facility)
Issue: Staffing
A/S EOC to Coordinate the ETA For Restoration Considering Clinical Urgency & Alternatives
Stage Steps: Action:
Inform A/S EOC of Status *IF STAFFING IS ADEQUATE APPROVAL WILL BE
GRANTED TO OPEN PRACTICE,IF NOT WILL BE MOVED TO
STAGE 3*
Issue: Equipment
Issue: IT/Telecommunications
Short Term1-Delayed Opening 2-Communication with patients,
physicians, & staff3-Monitor and reassess
Long Term 1-Extended Delay vs Alternative
location 2-Communication with patients,
physicians, & staff3-Charts/Meds/Equipment4-Monitor and reassess
Practice Recovery Process
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Practice Profile
Human Resources
IT
Property Management
Clinical Operations
Operations
Emergency Management
Service Specific Modules Data Field Example
1
2
3
4
5
6
7
Practice Level Entry Point
Physical Medicine
1554 Northern Blvd
Transitions of LI3rd Floor
Executive Summary Statistics:
Number of Practices Number of
Locations Number of
Service Lines Help/Hotline
Numbers
Landing Page
Practice Level Entry Point
Urology1554 Northern
Blvd
The Smith Institute for
Urology Waldbaum
Center
1st Floor
Practice Level Entry Point
OBGYN1554 Northern
Blvd
Ann and Jules Goittlieb
ComprehensiveWomen’s HC
5th Floor
Phone #, Hours of Operation
Practice Status Report
Snow Removal Vendor
Number of Employees
EHR, Reg, Billing
Site Visits
Scope of Practice
Overview of Database Structure
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99124
Smartphone App - Searching for Sites
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99125
Site Page – Key Status Indicators
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99126
Site Page – “Staff Check in”
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99127
Dashboard – Sites Followed
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 99128
Organizations need to invest in both Disaster Recovery and Business Continuity programs to ensure critical systems can be restored and functional services can be sustained when an event occurs. The two are co-dependent, not mutually exclusive.
Ensure essential business functions (IT and non-IT) can be sustained regardless of system availability Store data offsite Document offsite system recovery procedures
In Summary… Expect the Unexpected Be Prepared Invest Wisely Update plans frequently Test procedures regularly
What Does This Mean?
© 2014 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron Mountain Incorporated. All other trademarks and registered trademarks are the
property of their respective owners.
Iron Mountain Healthcare Services
Best Practices for Backup and Archiving
30
Review processes and policies: What should be
backed up – and for how long
Classify your data
Keep a copy of your data offsite
Think about archiving as it’s own discipline -
separate from backup
Develop clear policies with an understanding of
retention
Develop a tiered approach to archiving
About Iron Mountain
31
Iron Mountain provides information management services that help
providers lower the costs, risks and inefficiencies of managing their data.
60+ yearsservicing healthcare
2000+hospitals
48M ft3
healthcare records
1.5+Pbmedical images stored
45000hospital accounts
86M 60+M 5pieces of media stored/year images scanned/month data centers
- Offsite Tape Vaulting
- Server Online Backup
- PC Online Backup
- Data Restoration Services
- Escrow Services
- Medical Archive
- Vendor Neutral Archive
- Archival Tape Management
- Retention Consulting
Services
- Data Center Services
- Colocation Services
- Secure Media and IT Asset
Disposition
- Consulting Services
Backup ServicesArchiving ServicesData Centers and
IT Services
Iron Mountain Solution Portfolio
For More Information
Michael Leonard
Director, Health IT Services
617-535-2811
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Q&A
Click on the Q&A panel located in the lower right corner of your screen, type in your questions in the text field and hit send. Please keep the
send to default as “All Panelists.”
Slide Deck: http://goo.gl/6LiIR3Webex Support 1-866-223-3239
Event #667 969 991
Thank You!
• You will receive an email when our archive recording is ready. (Separate registration is required)
• Thanks to our sponsor: Iron Mountain!
• CHIME CHCIO Credits – Attending our Webinars = 1 CEU
• Questions/Comments – Anthony Guerra [email protected]
Go to www.healthsystemCIO.com/webinars to view our upcoming schedule and see the last 12 months of archived events.
