Headline here

1
The Missing Pieces to Your BCP Program Continuity
Insights Monday, April 27, 2009 Kathy Lee
Patterson, CBCP Childrens Hospital of
Philadelphia
2
Are there missing pieces to your BCP program?
Agenda for Presentation

• Assess your current status of preparedness
• What are your missing pieces
• BIA and mini-BIA
• Downtime planning with clients
• Projects that change your environment
• Funding and senior management support
• Tabletop exercises that can be routinely
  conducted
• Summary

3
Different Industries

• My experience is mostly in healthcare
• A childs life is our utmost concern and
  influences our every decision
• Your industry has crucial functions, just
  different by-products
• Sharing different techniques can be helpful for
  your program
• Goal - one good idea to take home with you!

4
Is something missing from your program?

• Is it
• Project work - A process for keeping up with new
  systems coming into your environment
• Funding - For your initiatives
• Education - The ability of train and test
• Information Accuracy - Having automated
  configuration management
• Client opinion - champions in organization
• Escalation procedures
• ??? (What is yours?)

5
Assess Your Progress and Set Goals

• List goals you would like to accomplish in next
  9-12 months
• If you are new to the organization, evaluate what
  has already been accomplished
• Every organization has strengths and weaknesses,
  build on them
• Do you have a program charter?
• Estimate funding for these goals
• List resources for these goals
• Verify that management is on board
• Dont assume anything (BIA was performed, but was
  it done the way you would do it?)
• Start implementing steps to achieve goals

6
IS Disaster Preparedness Are there missing
pieces here?

• Do you have a current application and hardware
  inventory?
• Assess the current state of your application and
  hardware recovery
• A survey specifically directed to technical
  responsibilities was developed
• Develop a separate survey form for the IS
  Department
• Interview each group leader within IS
• Inventory all equipment, systems, applications
• List each resource associated with each type of
  technology
• What applications are on all equipment?
• Which applications can be made Tier 1 high
  availability?

7
Questions to ask the Technical Staff w/survey

• What is your applications Tier Level and
  recovery strategy?
• Has integrity of back up media been demonstrated?
• Are there network diagrams and telecom
  information.
• Do they have written recovery procedures for
  equipment failure?
• Which IT staff work directly with clients and
  clinicians?
• If entire data center went black, what is your
  sequence of restore?
• Who keeps the detailed information on vendor
  contracts responsibilities?

Use this information to update your DR Plan
8
IS Incident Escalation Implementation Are
there missing pieces here?

• Established formal escalation procedures for IS
  to follow for Tier 1 system downtimes
• Establish policy for communication during
  downtime disruptions that are approved and
  followed
• Establish a threshold putting users into downtime
  procedures at one time to alleviate confusion
• At crucial times of year for your organization
• 1 hour or more of downtime
• Upon declaration of a full disaster

Handout provided at session.
9
Client Dependencies on ISAre there missing
pieces here?

• Would you benefit from conducting a full BIA?
• Do you have senior management support for a BIA
• Meet with senior management to find out what they
  really want to learn from a BIA
• Set objectives before you customize questions
• Make questions to fit objectives
• Dont ask a question if you dont need the data
  example asset management do you need it for
  BIA?
• Plan to present a report to match senior
  managements expectations.
• Can be referred to as a reassessment if BIA
  has negative connotations.

10
More Reasons to Perform a BIA

• Is there additional data that would be
  appropriate to reveal at this time example
  patient safety impacts?
• Have user departments requirements for recovery
  changed?
• Do departments have documented downtime
  procedures in place?
• Are their gaps in client/clinical needs?
• Position yourself to accomplish (Get senior
  management on your side)
• Tip Provide an application list so that
  participants use the same name for applications
  i.e., Exchange, Outlook, email, etc.

11
Impact to Patient Safety during a Tier 1
Application Disruption
Participants were asked how quickly patient
safety would be affected in the event that the
Tier 1 Applications experienced a significant
disruption.
12
Additional Questions Specific to Your Industry
for BIA

• Do business units have recovery process for
  inputting data back into systems after a downtime
  event? Where are they stored?
• Is there a back up application that can be used
  when primary system is not available? Who is
  trained on it?
• How long can your department continue functioning
  using downtime procedures?
• Do you require additional staff when systems are
  not available?
• Who exactly is required to input back logged
  information (Requirements - doctors or nurses?)
  and how many?
• Can you think of specific questions for your
  industry that you could ask at next BIA?

13
Mini-BIA Are there missing pieces here?

• Your BIA data can be used to your benefit if you
  keep the data current. One way to do this is
  with a Mini-BIA.
• Use after BIA has been conducted to keep data
  current
• Introduction of Mini-BIA for new or upgraded
  applications
• Pick crucial questions that help you assess RTO
  and RPO
• Take Mini-BIA to help shape requirements for
  infrastructure build for application
• Use this data to design architecture to meet
  clients needs
• Have this data put into BIA database for future
  needs
• Stats and metrics can be pulled to assist your
  organization
• Example Upgrade of application, can pull cost of
  downtime to support need for HA.

14
Project Work Are there missing pieces here?

• Have you been able to penetrate project planning?
• Are projects implemented without DR/BCP planning?
• What requirements do you expect during the
  project?
• Are you permitted to get involved in projects
  from the onset?
• Suggest having a policy and procedures with
  easily understood checklists
• Use Mini-BIA for project requirements at
  beginning
• Your involvement can help shape requirements for
  infrastructure build for application.
• Your input can save money for organization by not
  building a system more robustly than it needs to
  be
• Has this data put into BIA database for future
  needs
• Go-live readiness form it is a requirement?

15
Now that you have your technical system
information . . .

• Lets move to getting the future funded by senior
  management

16
Funding - Are there missing pieces here?

• It is important to advise senior management of
  the status of your work
• The good work that has been accomplished
• A brief history of all that has been done to date
• The roadblocks you are facing
• The creative ways you can keep funding to a
  minimum
• Why your recommendations should be approved
• Use examples from other competitors (example
  hospitals BCPWHO
• Where you need their assistance
• Heres how we did it -

17
Brochure of History and Goals
Now you can take all of this information and
develop a marketing tool to Advance your Program
---- Develop a brochure with history of the
growth of your organization Example will be
provided at conference.
18
Awareness Training - Are there missing pieces
here?

• Establish Training for your Program
• Tabletop Exercises
• Downtime Task Force
• Workshops for Downtime Planning with Clients
• IS Escalation Training with Job Action Sheets
• Problem Manager
• Subject Matter Expert
• DR Exercises
• Show progress by developing job aids and
  workshops

19
Tips for Conducting a Tabletop Exercise for IS
Disruption

• To begin pick a scenario that will address
  outstanding issues within your environment that
  you would like to correct.
• Chose a scenario that has relevance
• Develop slides to walk through the scenario
• Ask select executives participate
• Dont give all the directives make them figure
  out how to solve the problems
• Use envelopes and announcements for surprises
• Make it challenging but not ridiculous
• Finish on a positive note
• Make certain you thank them for their time and
  input
• Collect evaluation forms for feedback at end.

20
Training - Bridging the Gap between Clients and
IT

• If you are part of IT, there are ways to
  incorporate clients needs into your IT BCP
• Create a timetable of critical outputs
• Quick Reference Guide for work-arounds
• Downtime containers
• Downtime PCs with static info
• Monthly committee meetings with IS and clients
• Mobile carts with critical applications
• Client workshops

21
Downtime Workshop for Clients

• Design a working session with clients and key
  Leaders
• Develop scenario to fit your organizations needs
  
• Scenario - No computer systems or network
  available (Phones and faxes, too?)
• Invite more than you want they wont all be
  able to attend.
• Set up the room so that conversation flows
• Use easel for documenting issues
• Provide refreshments and give promotional items
  (if poss.)
• Start the session with a brief slide show can get
  them motivated to participate

22
Example Our Clinical Downtime Workshop

• Our Scenario
• All systems are unavailable due to a data center
  fire
• Eight-month-old sick baby arrives at ED
• Asked clinicians (clerks to attendings) to step
  you through how to render patient care without
  systems, ordering labs, medications, food, etc.
• Gave participants time to walk through what they
  would do
• Discovered that functions were performed by
  different levels
• Document the gaps and issues

23
Anticipated Results of Workshop

• A better understanding of how your business flows
  without systems (different roles in different
  departments)
• Gaps in available information and
  responsibilities
• How well the downtime procedures are used
• Gaps in training
• The champions in clinical environment to help you
  get things done
• (Example Discovered that there was one fax
  machine for all five pharmacy units. When system
  down, can everyone use same fax?)

24
Downtime Procedures (BC Plans) for Departments
Are there missing pieces here?

• Each business unit should have their own
  customized downtime procedures
• Listing each application that they use
• Listing manual procedures for each application
• Would including telephone instructions for
  receptionist to handle downtime keep panic from
  occurring?
• Include telecommunications downtime procedures
  what if only telecom goes down?

25
Summary

• If you are new to the organization, assess what
  is already in place and what needs to be
  accomplished with priority
• Meet with senior management to obtain commitment
  and define scope and future objectives
• Work with individual departments to build their
  downtime procedures (BC plans) provide a
  template
• Establish the IT recovery strategy and tier
  structure
• Serve the clinical staff by bridging the gap
  between the clinical environment and IS technical
  environment.
• Be a promoter!

26

• YOU CAN DO IT!

Any Questions?