ISO 9001& ISO 9004: A Framework for Disaster Preparedness Revisited #3

The Disaster Setting  

In Spring 2004, I was contacted by a health care group from a major metropolitan area in the Northeast – they had read my February 2002 Quality Progress article using ISO 9001 & ISO 9004 for Disaster Preparedness. They asked for assistance in preparing a Disaster Recovery and Service Continuity Planning effort for their metropolitan area concerning the provision of healthcare services in the event of a disaster. What follows is a brief outline of my proposed plan.  

The Disaster Preparedness Outline  

To begin it is necessary to establish a map of health care resources and facilities in the metropolitan area and then determine what will be included in the Disaster Preparedness Plan. Next it is necessary to establish what secondary and tertiary resources and facilities will be needed to provide services in the event of a disaster. The provision of resources and facilities will require several alternative backup strategies since the nature and impact of a disaster is unknown and could adversely impact hospitals, health care facilities and surge resources included in one version of a disaster of a disaster plan.  

Next it will be necessary to identify the potential risks that could affect the provision of health care facilities. Once the risks have been analyzed, it is possible to prepare a plan to respond to emergencies more effectively as well as preserve health care resources. A disaster plan will:  

·      Help the planning authority fulfill its moral responsibility to protect citizens, health care workers, healthcare resources, the community and the environment;  

·      Facilitate compliance with government agencies;  

·      Enhance the healthcare community’s ability to recover from destroyed facilities, personnel losses, financial losses and the interruption of services;  

·      Reduce time loss in restoring services and facilities;  

·      Enhance image and credibility with the community. 

Elements Needed In A Disaster Recovery Plan  

The plan should be in two parts. The first part should evaluate operations, beginning by defining goals and appointing a steering committee. It should look for capabilities and resources, as well as hazards and vulnerabilities. It should look at evacuation plans, safety and health programs, physical security and risk management plans that may already exist and might be used. In addition, it is necessary to look for those areas that are vulnerable in the event of a disaster such as critical equipment and supplies, critical services – electricity, water, heat and cooling, vital personnel, etc.    

The second part is the plan. It is necessary to compile a list of emergencies and the likelihood of their occurrence. Based on this list, it will be possible to prepare a plan to minimize the effects of these occurrences on health care operations. The implementation of a plan would include employee training, as well as conducting drills, testing equipment and coordinating activities with the communities in the metropolitan area.  

Senior management (which must be identified and agreed upon) sets the tone for this project by issuing and supporting a mission statement. In it senior management should link the success of this recovery plan to the provision of healthcare services. In addition, the mission statement should define the purpose and help foster an atmosphere of cooperation.  

Project Initiation and Planning  

Project Initiation – Initiating a project for disaster recovery planning requires that certain factors be considered by senior management during initial planning, including: ·      Establishment of project objectives ·      Mission statement issued by senior management  

Project Planning – The purpose of project planning is to clearly identify the project tasks to be completed, responsibility for their completion and the schedule, including: ·      Determining what facilities, departments and processes will be reviewed ·      Establishing project milestones, including timelines ·      Assigning personnel and scheduling  

The Steering Committee – The development of a Disaster Recovery Plan must be completed by a group rather than a single individual. This group, the Disaster Recovery Steering Committee, reports directly to senior management and is chaired by a member of senior management. It provides the management vehicle for the project. They arrange for the necessary resources and report to senior management. Important responsibilities of the steering subcommittee are operations, information services, finance, auditing, personnel, risk management, safety and security personnel.  

Assessment of Risks and Vulnerabilities – The various healthcare facilities in the metropolitan area, at the very least, have liability, property insurance and workers compensation in place. This coverage will afford some financial support in the event of an emergency. FEMA also should be contacted for the potential range of their support (especially following the disaster of Hurricane Katrina). Other items would be a safety and health program, a process safety evaluation using ISO 9001/ISO 9004, a facilities closing plan, and so on.  

Threats and vulnerabilities need to be evaluated based on their potential impacts. Determination of the maximum permissible downtime for healthcare operations as a whole and key operations in particular must be gauged. Further determination needs to be made as to how long the healthcare operation can be down without a significant negative impact on any one critical application or function. The maximum permissible downtime will determine how quickly an alternative healthcare processing system or operating system must be made available. Again, ISO 9001/ISO 9004 can speed evaluation of health care processes.  

Elements of the Plan  

One of the first actions to be taken during the planning process is the most effective method of operation during backup. Where there is no backup capability, it is necessary to look for actions to mitigate downtime. Emergency operating methods must address both immediate and long-term backups. The three-phase of emergency operations are:  

Emergency Backup – actions taken during this phase are reactionary. The purpose is to protect life and property and minimize loss. This phase is measured in hours.  

Immediate Backup – this phase provides short-term operating capability for critical activities, usually in a degraded mode. The speed with which an organization must move into immediate backup after a disruption in services is a function of the maximum allowable downtime. This phase is measured in days. 

Long Term Backup – when there is major damage to a facility, provision must be made for alternative operating methods and sites where operations can be brought back to acceptable levels. This phase is usually measured in weeks or months.  

Off-Site Storage of Critical Supplies – an important action that must be taken early in the planning process is the establishment of off-site storage of critical records, data and software as well as healthcare supplies The specific materials should be identified in the risk analysis phase of the project. Information technology is a critical element of disaster recover and contingency planning.  

Summary  

The importance of a well organized and fully documented Disaster Preparedness Plan can’t be overemphasized. Policies and procedures governing activities prior to, during, and following an emergency situation must be understood by all persons involved in the planning process. Use of ISO 9001/ISO 9004 is employed throughout the planning process. While blog space doesn’t permit an in-depth  discussion of disaster preparedness planning, this brief outline provides an understanding of how ISO 9001/ISO 9004 can be applied to healthcare services in a metropolitan area. If you have disaster preparedness concerns, you can contact me for a free preliminary consultation at theguide1@comcast.net.