Healthcare Cyber Attack Continuity Plan Operations

Topic Collection Cover Page

Continuity of Operations (COOP)/ Business Continuity Planning
Topic Collection
October 10, 2022

Topic Collection: Continuity of Operations (COOP)/ Business Continuity Planning

Disasters and public health emergencies can have a significant impact on healthcare personnel and facilities. Plans and mitigation efforts that allow medical facilities and providers to sustain their mission, core essential functions, and services for patients already receiving care, as well as respond to potential surges in patients with space, staffing (including leadership), and equipment/supply issues are required. The goal is to ensure continuity of operations and facilitate operational and financial recovery.

Continuity of Operations Planning (COOP) is the term favored by public and government entities for mitigation and planning strategies that create resilience and allow services to continue to be provided in the face of a range of challenges. Business Continuity Planning (BCP) is a similar term more often used in the private sector that focuses on both maintaining service delivery and receiving payment for those services provided. BCP in the past often referred to computer systems but now applies to all vulnerable resources.

The resources that follow highlight selected plans and planning guidance, lessons learned, tools, and promising practices for healthcare facility BCP. Additional related resources may be found in the Hazard Vulnerability/Risk Assessment, Cybersecurity, Electronic Health Records, Recovery, and Utility Failures Topic Collections.

Each resource in this Topic Collection is placed into one or more of the following categories (click on the category name to be taken directly to that set of resources). Resources marked with an asterisk (*) appear in more than one category.

Must Reads

This toolkit provides examples for hospitals to follow when developing their continuity plans. It is a companion document to the California Hospital Association's Hospital Continuity Program Checklist.

The author describes an approach to integrating risk management practices into business continuity programs for hospitals.

This article discusses the New York City Regional Healthcare Supply Chain Regional Resiliency Assessment Program (RRAP) project conducted by the Department of Homeland Security (DHS) at the request of healthcare representatives in the New York City region. The project findings could assist health care facility planners with developing the supply chain-related aspects of their recovery plans.

The authors describe a risk management process to mitigate the effects of IT and Communications failures on patient care. They discuss lessons learned to assist other facilities with planning.

FEMA shares links to information and guidance on continuity planning, online courses, exercise and training materials, and planning templates.

This article summarizes lessons learned from leaders of urgent care organizations located throughout the U.S. that have experienced natural disasters or other emergencies. Recovery considerations related to staffing, staff support, and medical and non-medical supplies, are discussed.

This document contains guidance for hospitals to develop continuity of operations plans, and includes a checklist of required elements and a template for an annex to be completed and attached to a hospital's Emergency Operations Plan.

This article describes a model for evaluating and assigning staff for emergency response in the hospital setting to achieve surge capacity using only internal resources. The authors designate those staff that are not assigned to an emergency support function to augment those that are.

The Business and Continuity of Operations Panel of the American College of Chest Physicians developed a series of questions related to supply chain vulnerabilities during disasters that healthcare facilities should be asking as they create their response plans. The authors provide 18 suggestions to mitigate these vulnerabilities focused on medication/ medical supply shortages and continuity of information technology (IT) operations.

This guide includes an overview of healthcare continuity of operations planning, customizable templates, and other related resources. It includes links to information on continuity planning, online courses, and other COOP resources.

This report features information on the "Hospitals Segment" within the Healthcare and Public Health Sector and Direct Patient Healthcare Subsector. The authors share results from assessments and recommendations for improving system and facility resilience.

Education and Training

This hour-long course provides an overview of continuity of operations planning and how it supports maintenance of essential functions during emergencies or disasters. It is targeted to hospital, community health center, and long term care managers responsible for developing a COOP plan.

This eight-hour course covers fundamental continuity principles and processes and a focused exercise on the special continuity requirements for pandemics.

This two-hour course is designed to provide both tools and practical knowledge necessary to develop an organization's devolution plans and procedures.

This hour-long course provides an overview of pandemic influenza and strategies for continuity during a pandemic.

This hour-long course provides participants with a basic understanding of continuity of operations planning.

This two-hour course describes the Continuity Management Cycle and how it should be used to develop a plan.

The Continuity Excellence Series provides a curriculum for earning a certificate as either a Professional Continuity Practitioner (Level I) or Master Continuity Practitioner (Level II).

This presentation provides a comprehensive overview of continuity planning for health care, including information on process and plan elements.

This one-hour course: introduces the concept of continuity of operations and define its objectives and scope; defines the organizational context of a continuity of operations policy; offers an outline for a continuity of operations plan; and emphasizes the importance of broad organizational participation in the development, training, and testing of continuity of operations plans.

This page links to an e-learning platform consisting of continuity guidance, tools, templates, and plan examples for small and rural hospitals.

Event-Specific Lessons Learned

The authors examined how power outages in Washington, DC, and five counties in West Virginia and Maryland impacted operations in a sample of 36 hemodialysis centers. They found that those with pre-existing plans, including provisions for back-up generators and referral agreements with other dialysis centers, offered continuity of care to their patients.

The authors interviewed 30 key informants (KI), including health and social service providers that provide healthcare to the under- and uninsured along the Mississippi and Alabama Gulf Coast. Pre-disaster issues of importance were patient education and preparedness; evacuation guidance and support; planning for special medical needs shelters; and health care provider preparedness. Post-disaster issues were communication; volunteer coordination/credentialing; and donation management, particularly for medications.

The authors interviewed 30 key informants (KI), including health and social service providers that provide healthcare to the under- and uninsured along the Mississippi and Alabama Gulf Coast. Respondents indicated that mental health, diabetes mellitus, hypertension, respiratory illness, end-stage renal disease, cardiovascular disease, and cancer were medical management priorities after a disaster. The most frequently mentioned barrier to providing care was maintaining continuity of medications. Inaccessible medical records, poor patient knowledge, and financial constraints also impacted care. Implemented or suggested solutions included better pre-disaster patient education; support for electronic medical records at community health centers; and better management of donated medications/medical supplies.

The author, an architect, describes how the Southeast Louisiana Veterans Healthcare System was rebuilt by applying the lessons learned from that disaster as well as unique needs of veterans. Key features of the new hospital are meant to ensure that it can continue operations for up to 5 days post-disaster impact, including placement of the Emergency Room on the second floor; placing the generator fill line above the 500-year flood line; placing the generator underground; and placing the power grid on the fourth floor of the hospital.

The authors describe the disruption of the computer systems at Mount Sinai Medical Center in New York City on a single day, the hospital's response to the event, and subsequent modifications to emergency plans incorporating lessons learned. They found that departments that utilized a combination of electronic and paper systems were impacted less than the Emergency Department, which was completely reliant on electronic medical records.

While the Long Beach Medical Center (New York) was rendered inoperable after Hurricane Sandy, their electronic health records (EHR) system remained functional. The authors share how the hospital's EHR system helped with continuity and record recovery.

The authors describe loss of functions and structural damage experienced by hospitals in Chile following a major earthquake. Loss of communications capability was cited by hospital administrators surveyed as being most problematic.

This report describes response and recovery operations by several hospitals during the 2011 natural disasters in Missouri. It summarizes lessons learned, with a focus on the Joplin tornado.

This article describes the planning one health center undertook to secure its data so that it could be accessed after a disaster, and discusses why healthcare information technology must be a priority focus for planning. The authors advocate for increased federal funding and clear guidelines from federal planning partners in support of physical security, data back-up, and redundancy planning, as well as staff training to support these technology needs.

General Information

This ASPR TRACIE TA response provides COOP resources and templates specific to state and local health departments. Related Topic Collections: Continuity of Operations (COOP)/ Failure Plan, and Recovery.

* California Hospital Association. (n.d.). Continuity Planning. (Accessed 5/22/2019.)

This website links to webinars, conference presentations, toolkits, and guidance documents to help hospitals create business continuity plans.

The author describes an approach to integrating risk management practices into business continuity programs for hospitals.

This article discusses Application Impact Analysis, and a risk-based approach to business continuity planning that considers business aspects such as Financial, Operational, Service Structure, Contractual Legal, and Brand.

FEMA shares links to information and guidance on continuity planning, online courses, exercise and training materials, and planning templates.

This paper discusses an Australian hospital's experience developing a business continuity planning framework, including key issues considered and how the planning effort was conducted.

This article discusses the three Cs of continuity planning: contingency planning; continuity capability; and crisis response. The author contends that all three are needed to develop a robust response to emergencies or disasters.

Though written for healthcare facilities in Australia, this document contains detailed directions and tools that healthcare facilities here in the U.S. may reference to conduct a Business Impact Analysis.

This article discusses how to maintain continuity of services in healthcare is achieved for one healthcare system, HCA Healthcare, when faced with natural disasters such as hurricanes and tornadoes. The author emphasizes healthcare preparedness coalitions and government efforts to recover after a disaster.

The authors interviewed managers and emergency planners at hospitals and public health agencies to determine factors associated with health worker absenteeism during a biological emergency. They present data on expected absenteeism rates and individual determinants of absenteeism, and provide recommendations for hospitals, emergency medical services organizations, public health organizations, and government agencies to minimize absenteeism. Though not specific to COOP, this document provides guidance on a key facet of maintaining hospital operations.

This document, created by a consulting firm, discusses general strategies for gaining leadership support for continuity planning. It includes a link to a Business Impact Analysis Checklist for Continuity Managers that may be helpful in crafting or vetting a facility approach.

This 70-page document describes the four capabilities that healthcare coalitions and individual healthcare facilities need to prepare for, respond to, and recover from emergencies. The capabilities are: foundation for healthcare and medical readiness; healthcare and medical response coordination; continuity of healthcare service delivery; and medical surge. For example, Capability 1, Objective 4 covers training and preparing the healthcare and medical workforce (Objective 4, Activities 3-5 also contain specific information about exercises within the HPP program) and Capability 3, Objective 7 is focused on coordinating healthcare delivery system recovery.

This presentation provides an overview of the State of Ohio's approach to building its continuity of operations program. It includes the steps the state followed and has recommended for its counties and local governments.

The authors discuss the use of an Emergency Support Function framework to manage surge capacity and eliminate the need for external staff to meet patient care needs during a disaster. They reference the Joint Commission's hospital emergency preparedness standards that require hospitals to participate in community-wide response for resource coordination and allocation, and emphasize how important it is for hospitals to remain open to support community resilience.

Though some of this presentation is focused on Johns Hopkins, much of it includes generalizable information for other organizations, including: the importance of having continuity procedures that staff regularly practice to maintain patient safety; sample downtime plans; and solutions for challenges experienced during events (e.g., those related to the revenue cycle).

This directive establishes a comprehensive national policy on the continuity of Federal Government structures and operations and a single National Continuity Coordinator responsible for coordinating the development and implementation of Federal continuity policies. This policy establishes "National Essential Functions," prescribes continuity requirements for all executive departments and agencies, and provides guidance for State, local, territorial, and tribal governments, and private sector organizations in order to ensure a comprehensive and integrated national continuity program that will enhance the credibility of our national security posture and enable a more rapid and effective response to, and recovery from, a national emergency.

The Department of Homeland Security, in coordination with its interagency partners, developed this Federal Continuity Directive (FCD) to provide operational guidance to implement the National Continuity Policy. It defines the required elements of a continuity program: delineation of essential functions; succession to office and delegations of authority; safekeeping of and access to essential records; continuity locations; continuity communications; human resources planning; devolution of essential functions; reconstitution; and program validation through testing, training, and exercises (TT&E).

This document includes information to support the conduct of a Business Impact Analysis for a hospital.

The authors developed a framework for key indicators of hospital resilience, which they categorized into eight domains, 17 subdomains, and 43 indicators. They contend that the framework may be used for assessment purposes, as well as to inform priorities for emergency response.

Guidance/Guidelines

The Continuity Guidance Circular "serves as a resource for federal and non-federal entities to guide, update, and maintain organizational continuity planning efforts and appropriately integrate and synchronize continuity efforts." The document covers building and maintaining continuity capabilities and includes a planning checklist in the appendix.

International Organization for Standardization. (n.d.). Standards. (Accessed 5/22/2019.)

International Organization for Standardization (ISO) is an independent, non-governmental membership organization and the world's largest developer of voluntary International Standards. See standards ISO 22313, ISO 22301, ISO 22300, ISO27003, ISO 27004, ISO 27031, ISO 27033-1 and ISO 27035 for business continuity-related standards.

NFPA 1600 establishes a common set of criteria for all hazards disaster/emergency management and business continuity programs.

This guide supports the efforts of the public and private sector Critical Infrastructure and Key Resources community and their businesses to develop and execute business continuity preparedness and response plans for a pandemic. The primary government and pandemic influenza-specific background material, references, and contacts are included. Public health and healthcare is one of the critical infrastructure areas.

Information Technology (IT) and Utility Issues

This checklist can be used to support a healthcare facility's response to an outage of a critical utility, including the implementation of downtime procedures to maintain services.

This document includes a series of questions to guide hospitals in planning for utility failures associated with systems such as power, water, heating, ventilation, air conditioning, medical air, vacuum, or medical gases.

This document provides a four step process for the development of a hospital emergency water supply plan and includes tips for assembling the right planning team, performing a water use audit, analyzing alternatives, and developing and exercising the plan.

This presentation discusses why healthcare IT is particularly vulnerable to failure and its negative impacts; how emergency management and IT staff can collaborate to enhance preparedness; and how to use the provided framework for continuity of operations planning aimed at mitigating the effects of IT system failure and unplanned downtimes.

The authors describe a risk management process to mitigate the effects of IT and Communications failures on patient care. They discuss lessons learned to assist other facilities with planning.

This brief article outlines key points to consider when preparing IT infrastructure continuity plans.

This document can help healthcare facility managers and planners increase resilience, plan for extended power outages, and create and store enough power on-site to operate in "island mode" for a prolonged period of time without outside sources of power or fuel. It outlines challenges and opportunities to solve a number of high-impact threats to critical infrastructure that can result in a regional or nationwide months-long power outage, making it unlikely for timely outside help to arrive.

This document highlights issues for healthcare facilities to consider regarding power outages. It also provides a checklist of key planning considerations, and recommendations for fostering a relationship with a facility's utility company.

This document provides information on the impact of water loss on healthcare facilities, and a series of questions for planners to use to prepare their facilities for water service interruptions.

This fact sheet summarizes steps a healthcare facility can take to ensure communication during incident response when normal technologies fail.

The authors identified and characterized 116 health information technology outage incidents in China. They found that about 70% of outages occurred in the morning and over 50% disrupted patient registration and payment systems. The main causes for outages included software defects, overcapacity issues, and malfunctioning hardware.

In this article, the Chief Technology Officer (CTO) for a large hospital system discusses the processes used by his team to build a strong IT disaster recovery program and plan. Namely, he notes how critical it is to have the right infrastructure in place to support applications; how project management is handled; how priorities are determined for applications; and how to get leadership buy-in and financial support for disaster recovery planning.

This article discusses key questions for developing an IT continuity plan, strategies for protecting an organization's IT network, and how the cloud environment can support continuity planning.

Non-Hospital Setting Continuity Planning

This document provides tips for developing a continuity plan that takes all essential functions into consideration, and includes considerations for staff absenteeism of up to 40%.

This PowerPoint presentation is a training on how to use the California Association of Health Facilities Continuity of Operations Plan Template for Long Term Care Facilities, listed in this Topic Collection.

This is a continuity of operations plan template for long-term care facilities that may be customized as needed.

This newsletter dedicated to continuity of operations contains a healthcare section, with links to continuity planning tools for nursing homes, community health centers, and home care services.

This resource includes business continuity planning tools and templates for use by health centers and other providers. (Note: Contact CHCANYS at emteam@chcanys.org for the most current Word versions of this template.)

* Maryland Emergency Preparedness Network. (n.d.). Provider Resources. (Accessed 1/10/19.)

This webpage includes a link to an Emergency Preparedness Resource Guide for Home Care Providers, which includes sections on emergency planning and business continuity planning. There are also links to fillable forms that support the Emergency Preparedness Resource Guide.

This document discusses the core components of a business continuity plan, and how to develop plans to ensure that health centers continue to function during emergencies or disasters.

This presentation discusses continuity of operations planning for EMS agencies.

This resource is a business continuity plan template for long-term care and skilled nursing facilities.

This webpage includes links to resources to assist certified community behavioral health clinics (CCBHCs) with developing continuity plans.

This hour-long course discusses continuity of operations planning for a community health center, and describes how to develop protocols to allow a community or regional health center to supplement hospital care during an emergency.

This business continuity template may be referenced and adapted by other home care agencies developing their own plans.

This document provides an overview of key continuity of operations issues faced by the laboratory community. It is designed to aid Principal Investigators in considering the additional protection and steps that should be taken to protect laboratory personnel and the other functions being conducted. Although many of the elements are common to academic teaching and support departments, some are highly specific to laboratories, and their successful preparedness requires specialized emergency resources and planning.

Plans, Tools, and Templates

This document provides tips for developing a continuity plan that takes all essential functions into consideration, and includes considerations for staff absenteeism of up to 40%.

This document provides a laboratory COOP, which is a comprehensive, pre-event plan that describes the procedures, policies, and arrangements necessary for a laboratory to respond quickly and effectively to a wide variety of possible disruptions or threats. It describes what is in place, what the laboratory does to respond, and what is required to maintain the COOP. Although developed for public health laboratories, it can be adapted for use by hospital laboratories.

This is a continuity of operations plan template for long-term care facilities that may be customized as needed.

California Emergency Medical Services Authority. (2014). HICS Forms.

The following forms can be found on this page and can be helpful to those creating a COOP: HICS 251 - Facility System Status Report; HICS 252 - Section Personnel Time Sheet; HICS 256 - Procurement Summary Report; and HICS 257 - Resource Accounting Record.

The following Job Action Sheets can be found on this page and can be helpful to those creating a COOP: Business Continuity Branch Director; IT Systems and Applications Unit Leader; Services Continuity Unit Leader; Records Management Unit Leader.

* California Hospital Association. (n.d.). Continuity Planning. (Accessed 5/22/2019.)

This website links to webinars, conference presentations, toolkits, and guidance documents to help hospitals create business continuity plans.

This planning template provides guidance on ensuring that essential business functions are continued in the event a disaster or other untoward incident disrupts normal healthcare facility business operations.

While it contains some guidance specific to facilities in Australia, the key considerations for managing EMR downtime found in this document may be useful to U.S. healthcare institutions in the development of their business continuity plans.

This fact sheet summarizes steps a healthcare facility can take to ensure communication during incident response when normal technologies fail.

This template (partially customized for a Diagnostic Imaging Department), may be used as a reference for other hospitals in developing a business continuity plan.

This resource is a detailed template to support business continuity planning and plan document development used by Johns Hopkins. It may be used as a reference by other organizations in building their continuity programs and plans.

* Maryland Emergency Preparedness Network. (n.d.). Provider Resources. (Accessed 1/10/19.)

This resource can assist hospitals and other healthcare organizations with improving their readiness for unplanned IT downtime events. It discusses planning approaches, and key considerations for these types of events.

This sample template is specific to information system continuity and can be tailored by emergency planners in a variety of settings.

This document was developed by the Emergency Management team at Children's Hospital Colorado (CHCO) in collaboration with over 200 CHCO managers. It is meant to serve as a template for healthcare facilities as they request departmental information necessary to develop a Continuity of Operations (COOP) plan. It is CHCO's version of a Business Impact Analysis. (The name was changed to be more reflective of the data being collected.)

This Ready.gov website provides resources and other information to assist with continuity planning.

The authors present an overview of continuity of operations planning (COOP) and a COOP plan template, and review how to complete the template and associated worksheets.

This resource is a business continuity plan template for long-term care and skilled nursing facilities.

Healthcare facilities can tailor this continuity of operations plan template to their use. Annex templates for the plan are also available on this website.

This tool can help healthcare executives prepare their facility finances for a large-scale public health emergency. This model estimates the resources needed by healthcare department (e.g., administration, emergency room, facilities, information and technology) during a disaster. Users can also calculate the amount of cash reserves an executive may need for maintaining operations while awaiting reimbursement from insurance companies or government agencies.

This online toolkit can help healthcare facility planners learn more about implementing best practices in climate resilience. It is based on a framework composed of the following five elements: Climate Risks and Community Vulnerability Assessment; Land Use, Building Design, and Regulatory Context; Infrastructure Protection and Resilience Planning; Essential Clinical Care Service Delivery Planning; and Environmental Protection and Ecosystem Adaptations.

This toolkit is intended to provide business leaders that are new to pandemic planning with information regarding high-priority Human Resources (HR) issues related to business operations during influenza pandemic. While some of the links in the presentation are outdated, the presentation provides a valuable overview of issues and tasks.

This manual was developed to provide guidance to local governments for the development and maintenance of Continuity of Operations (COOP) plans. This manual is intended to offer both procedural and operational guidance for the preparation and implementation of a COOP plan. The COOP Worksheets correspond with Virginia's seven phases of the COOP planning process. Completing the worksheets assists in assembling the information necessary to develop the critical elements of a COOP plan.

This business continuity template may be referenced and adapted by other home care agencies developing their own plans.

While focused specifically on the Yale campus, this guide be used as a reference to assist health providers in the development of procedures to respond to an incident that disrupts normal business operations.

This webpage includes links to support continuity planning for clinical practices. Included is a Guide to Business Continuity and Recovery Planning, which provides detailed guidance and planning templates clinical practices may use to build their continuity plans as well as worksheets to assist the departments.

Agencies and Organizations

floresthemannind.blogspot.com

Source: https://asprtracie.hhs.gov/technical-resources/17/continuity-of-operations-coop-business-continuity-planning/110

Healthcare Cyber Attack Continuity Plan Operations

Topic Collection: Continuity of Operations (COOP)/ Business Continuity Planning

Must Reads

Education and Training

Event-Specific Lessons Learned

General Information

Guidance/Guidelines

Information Technology (IT) and Utility Issues

Non-Hospital Setting Continuity Planning

Plans, Tools, and Templates

Agencies and Organizations

Belum ada Komentar untuk "Healthcare Cyber Attack Continuity Plan Operations"

Posting Komentar

Iklan Atas Artikel

Iklan Tengah Artikel 1

Iklan Tengah Artikel 2

Iklan Bawah Artikel