DANA-FARBER CANCER INSTITUTE (DFCI;Boston, MA) is a world renowned cancer care and research institute that sees more than 168,000 ambulatory patients annually, with in-patient care provided at Brigham and Women's hospital, located right next door. DFCI is a teaching hospital for Harvard Medical School, and researchers also work closely with the university. In the past 10 years, DFCI has grown from a $50 million a year operation to a $550 million a year healthcare giant. During that time, integration between research and clinical care has become more complex and highly dependent on information technology. Improving existing emergency management plans to mitigate risk to patients, staff, and DFCI operations is essential to manage risk in this rapidly changing environment.
Where to Begin?
Business continuity practices in healthcare, particularly among providers, have historically not been well established. DFCI was on its own to develop a model to address the unique challenges it faced. Unlike many other industries, during a time of disaster healthcare providers must maintain, if not increase, their capacity to operate. Relocating operations to an alternate site is not an option. DFCI needed an integrated program to address emergency management, business continuity, security, and disaster recovery. To that end, DFCI decided to leverage its relationship with Partners HealthCare System, Inc. to implement the program. The Dana-Farber/Partners CancerCare alliance combines the strengths of DFCI with the founding members of Partners, Brigham and Women's, and Massachusetts General hospitals. Partners had already established a corporate disaster recovery and business continuity department, so it was able to support DFCI in developing its own DR/BCP program. Also during this time, Boston University was developing an Online graduate certificate program in Emergency Management and Organizational Continuity (EMOC) that was launched in March 2005. With twoof the members of the DFCI BCP project team sitting on the BU EMOC advisory board, the industry practices being taught in that program were applied to the business continuity program.
Jim Conway, DFCI chief operating officer, pulled together a project team and steering committee to spearhead the BCP effort. In addition, consultants were brought in to support the project. Conducting a business impact analysis (BIA) was the first priority. Understanding that this was a new process to DFCI, the questions were targeted to gather specific data used to identify critical functions, interdependencies, vital records, and reliance on information technology. Before questionnaires were completed, representatives from each department attended two-hour workshops where attendees were educated on the purpose of BCP and were given a tutorial on the BIA tool. After the BIA questionnaires were distributed, meetings were held with each of the departments to facilitate the data gathering and to help complete the questionnaires. While labor-intensive, the preparatory work paid off in awareness, understanding, and governance. In addition, the quality of the data captured during the BIA was significantly better than if participants completed the questionnaires without guidance. The data were then analyzed and presented to DFCI's BCP steering committee, where decisions were made on priorities, risk mitigation measures, and the scope of the program. It was determined that, in addition to Information Services and Telecommunications, the most critical departments (Pediatric and Adult Ambulatory Care; AIDS and Immunology Research Department; CALGB and Network Affiliates; Core Clinical Laboratories; Environmental Health and Safety; Health Information Services; Experimental Medicine; Access Management; and the Animal Research Facility) of the Institute's 62 departments (organized around clinical, research and business areas) would have comprehensive plans built,with the remaining 52 departments creating shell plans to be implemented as the program matured. The BIA revealed the vast array of specialized elements vital to managing a healthcare and research environment, such as medical equipment required in the infusion areas. In addition to ensuring that workstations and alternate workspace is available, the relocation needs for the research laboratories that make up 50 percent of DFCI operations had to be considered. Space is always at a premium, and a traditional hot site would be insufficient. Mutual aid agreements with other labs, hospitals, and Harvard University were pursued, and are either in place or being created. During an emergency, all vital elements for operation will be available and essential systems accessible. Identifying and prioritizing the information systems applications the departments rely on was a critical element in DFCI's business continuity plan. Approximately 100 applications support DFCI and, given the possibility of application downtime, a strategy for operating without its systems was needed. The solution: Downtime procedures are documented in the event applications are unavailable. Backup paper copies are kept to write patient orders and admit patients. An emergency management plan, called an E-4 Plan, details the escalation and notification procedures during an IS interruption. To mitigate the likelihood of downtime, many systems have built in redundancy. The most critical systems use high-availability storage, and applications like Chemo Order Entry and the Longitudinal Medical Record run on a platform that will soon be completely replicated across the two corporate data centers to provide an enhanced application continuity solution. Unlike businesses running a 9 to 5 operation, healthcare providers typically need 24/7 availability of their mission- critical applications. Less critical applications with a 24- or 72-hour recovery time objective are candidates for drop ship solutions or the use of par servers-servers that are housed in racks in the data center ready to be built on the fly in the event they are needed for recovery.
Partners HealthCare System, Inc. and DFCI work together to provide business continuity tools and services. The commercial software package used to build the DFCI plans is managed and supported by the Partners' IS Disaster Recovery and Business Continuity department. Interfaces between the personnel, real estate, and asset management databases and the plan building software were built in order to minimize data entry while maintaining the integrity and normalization of the data in the plans. This allowed staff to maintain personnel data in the sources of record they were accustomed to, and with regular updates from those databases, the integrity of the data in the team list and call trees is sustained. Several customized reports and screens were developed to reflect the unique needs of a healthcare organization, allowing for all the departmental BC plans, IT disaster recovery plans, and emergency management plans to be housed in one location. To facilitate the use of the tool and development of the plans, each department was interviewed to gather additional data that was entered into the software. A two-hour training session included a walk through of the plan and a software tutorial. Each plan owner was provided an interactive audio CD walking through the steps of maintaining the plans. As departments and DFCI develop their plans, a great deal of thought is given to the interdependencies with other hospitals and organizations. Mutual aid agreements for relocating patients and staff in a disaster have been established that include expanding the role of the DFCI during a mass-casualty incident. DFCI must be able to maintain operations during a disaster, as well help area hospitals manage the surge of patients who would flood local emergency rooms. At least once a year, drills are conducted in conjunction with other area hospitals and Boston's Emergency Management Agency. Drills are evaluated for effectiveness and need for improvement. However, the scope of planning and managing risk doesn't end here. DFCI has also undertaken an enterprise risk management initiative led by Michael Desocio, vice president of compliance and risk management. Desocio sees business continuity as a large part of the success of the overall initiative. Enterprise risk management and business continuity addresses certain areas of compliance required by HIPAA and JCAHO(Joint Commission on Accreditation of Healthcare Organizations). For example, priorities for disaster recovery planning were established as a result of the data gathered during the BIA. Efforts that address both those priorities and compliance requirements include establishing criteria for identifying and selecting critical applications, documenting and testing plans, documenting downtime procedures for applications, and a data backup and retrieval plan. That work will continue alongside the ongoing development of the business continuity program.
DFCI's BCP Product And Service Picks
Dana-Farber Cancer Institute (DFCI); Boston, MA) uses business continuity planning software and consulting services from Strohl Systems (King of Prussia, PA). BIA Professional®-This Web-based BIA tool aided in the development and completion of DFCI's business impact analysis. LDRPS®-This Web-based planning tool is used enterprise wide and is integrated with other key databases.
For several facilities, including offsite locations, preparing for incidents affecting operations is not new to DFCI. "Patients look to healthcare providers for continuous care and support. We have always planned for emergencies and BCP is an integral part of an institution's overall emergency management plan," says Liz Gross, director of environmental health and safety. A recent power outage at one of the offsite locations gave the DFCI an opportunity to see the value of BCP planning first hand. The outage served as both a real-life BCP experience and an opportunity to highlight what is needed for the BC program for offsite locations, such as notification and escalation procedures that involve off-the-building management, ensuring the administrator on call has access to the information detailing which departments are in each of the offsite locations, and the key internal contacts for that building. In addition, the DFCI's Environmental Health & Safety, Security, and Facilities departments regularly respond to incidents affecting the main campus. Specific emergency plans detail the response for specific hazards and incidents that may occur. Small flip charts are located in stairwells and at other key locations that provide staff, patients, and visitors with key information about what to do in the event of an incident-everything from a natural disaster to a fire. Each year, the DFCI's Emergency Preparedness committee performs a hazard analysis to score the organization's readiness and to determine its risk based on probability, impact, and level of preparedness to deal with scenarios such as hurricanes, fire, IS outages, and hazardous materials spills. Areas of increased risk are given priority and measures are put in place to mitigate that risk. Any time an incident occurs, the response is given a score out of 100 and is reviewed by both the Safety and Emergency Preparedness committees.
What started out as a project has begun to mature into an overall program. Sam Hanna, MBA, CISA, who directs the business continuity initiative, says "At Dana-Farber, we strive to provide quality, service, and safety to our patients and staff. Having a business continuity program ensures that we are able to deliver on these values during various situations." Every department in the business, clinical, and research areas, both on the main campus and offsite, will have a business continuity plan. Each facility will have a site emergency response plan. Developing strategies for operating in the event of a systems failure will continue tobe a priority. All the Institute's plans will be built using its software tool, which will integrate enterprise risk management, emergency management, disaster recovery, business continuity, and crisis management. "While a lot of work has been done, There is much more development, education and training to be performed to ensure that business continuity is a factor in all critical decisions," says Hanna. The leadership team at DFCI will continue to take the program further.
Angela Devlen manages the Disaster Recovery and Business Continuity program at Partners Healthcare System, Inc. She can be reached at (617) 724-5519.
Interview with Jim Conway, Dana-Farber COO
Hospitals are in a high-risk business. Increasing dependency on systems both improves efficiency and introduces a new element of risk in the treatment of patients. Patient safety has always been a priority for Dana-Farber Cancer Institute, but since the discovery of the accidental chemotherapy overdose of patient Betsy Lehman in February of 1995, there has been a relentless effort by staff and leadership to improve patient safety, reduce risk, and remain vigilant in its ongoing efforts to do so. Business continuity has been part of that effort. Jim Conway talks about the importance of patient safety, systems and process to ensure it and why this is all so important to business continuity. Why do you feel BCP should be important to leaders in healthcare? Leaders have to worry about BCP. First, as broadly as possible, then focus on the key areas, then knit it into other work at the Institution … particularly people who deal with safety, operations, and security. Integrating BCP with the business of the institution as opposed to a function off to the side not only provides a risk mitigation strategy but a business effectiveness strategy. Patient safety is especially important to you. How does business continuity help support that? As an institute, we were placed at business risk because of a tragedy here. Every healthcare organization is a high-risk organization. Given the complexity of our organizations and our systems, we've learned you have to go looking for trouble, and put in place systems to manage that complexity and the risk associated with it. BCP is just another element of managing that risk. My mantra is "Our systems are too complex to expect merely extraordinary people to perform perfectly 100 percent of the time. We as leaders must put in place systems to support safe practice."What is your vision for the BCP program over the next year/several years?I want to make sure that this remains an institutional process not just a separate BCP function. It should be vibrant program, with people in the institution aware of it, that we have used it not just in test but also in reality. Recognizing that it will not ever be 100 percent and there will always be learning.