The Leading Business Education Network for Doctors, Financial Advisors and Health Industry Consultants

Setting Up Your HIT Security System

By Richard J. Mata, MD, CIS, CMP™ [Hon]

In order for a healthcare organization to thrive, it must be able to continue to function no matter what the circumstances are.

When disaster strikes, the organization must mobilize all the talent and resources needed to continue their operations and return to a normal state as soon as possible.

Time is money, and in today’s economy, an hour could be worth thousands of dollars.  Every department in an organization has responsibilities during a disaster.  Planning for a disaster and then dealing with it is a team effort by all parts of an organization.

Phases of Healthcare Business Continuity Planning

A system is required to realize this objective, and part of this system is healthcare entity business continuity planning (BCP).

Phase One: Set up a BCP Project

The first step is to set up a BCP project, which includes feedback from key members from all departments.  Appoint a project manager who has a solid background in the clinical and financial systems and functions that the organization deploys or services it provides.  The project manager can work with business and system analysts to document business flow and interactions with computerized systems that may go down, and how the organization will function on a manual system until service returns.

Phase Two: Review Emergencies and Assess Business Risk

The second phase involves reviewing the different types of emergencies that can arise and assessing the risks to the various business processes already documented.  This is accomplished following a system or service function.

Phase Three: Prepare for Emergencies

The third phase includes identifying of back-ups and recovery strategies to mitigate the effects of an emergency.  A storage area network (SAN) or redundant server could be used as back-ups.

Phase Four: Plan for Disaster Recovery

The fourth phase involves the development of procedures to be followed by a Disaster Recovery Team where human life may be at risk.  A disaster might be caused by weather, sabotage, or electrical power and be specific to the particular organization and its business and IT infrastructure.

Phase Five: Plan for Business Recovery

The fifth phase is critical, and involves developing detailed procedures for the recovery of the business.  Again, the BCP project manager could use each business or service procedure that was documented in phase two and detail which financial or clinical systems are involved, what would be done if the systems were down, and what the plan for recovering the system might be.

Phase Six: Test Business Recovery Procedures

The sixth phase involves simulating authentic emergencies and testing of the business recovery phase.  For example, how would business processes or services be affected by an electrical outage?  How fast can a power generator pick up the outage – and what might happen after a timely pause?  How would patients who were receiving mechanical support be affected?  What would happen to the clinical laboratory?

Phase Seven: Train the Staff

Phase seven covers the training of all employees in the procedures necessary to manage the business recovery process.  These are the procedures tested in phase six, which may require modification.

Phase Eight: Maintain the Currency of the Plan

Phase eight includes treating BCP as a dynamic project to be kept up to date to reflect all changes to business processes and employee structure.

Conclusion

Your thoughts and comments on this ME-P are appreciated. Feel free to review our top-left column, and top-right sidebar materials, links, URLs and related websites, too. Then, subscribe to the ME-P. It is fast, free and secure.

Speaker: If you need a moderator or speaker for an upcoming event, Dr. David E. Marcinko; MBA – Publisher-in-Chief of the Medical Executive-Post – is available for seminar or speaking engagements. Contact: MarcinkoAdvisors@msn.com

OUR OTHER PRINT BOOKS AND RELATED INFORMATION SOURCES:

• PRACTICES: www.BusinessofMedicalPractice.com
• HOSPITALS: http://www.crcpress.com/product/isbn/9781466558731
• CLINICS: http://www.crcpress.com/product/isbn/9781439879900
• ADVISORS: www.CertifiedMedicalPlanner.org
• FINANCE: Financial Planning for Physicians and Advisors
• INSURANCE: Risk Management and Insurance Strategies for Physicians and Advisors
• Dictionary of Health Economics and Finance
• Dictionary of Health Information Technology and Security
• Dictionary of Health Insurance and Managed Care

Filed under: Information Technology, Practice Management, Professional Liability | Tagged: business continuity planning, CCHIT, EHRs, EMRs, Health I.T., HIPAA, National Institute of Standards and Technology, ONC, Richard J. Mata, SAN, www.certifiedmedicalplanner.com, www.healthcarefinancials.com |