Quick Safety 41: Emergency management: Need for continuity of operations planning

May 22, 2018

Update: November 2022

Issue:

Power failure, fire, flood, industrial accident, cyberattack — disasters such as these can put both health care organizations and their patients at risk. The critical need for continuity of operations planning (COOP) is most evident when an organization becomes the victim of an emergency. This planning provides health care organizations with the resilience needed to protect, respond, recover and restore essential patient care services. Following a disaster, an organization’s capability to provide care, treatment and services to patients can be disrupted for days, weeks, several months or longer.

Continuity of operations planning “ensures the ability to continue essential business operations, patient care services, and ancillary support functions across a wide range of potential emergencies. The health care organization’s continuity of operations planning may be an annex to the organization’s emergency operations plan (EOP) and during a response should be addressed under the incident command system (ICS).”1

When the health care organization itself is compromised, so is patient safety. In the aftermath of emergencies, disruptions in health system capabilities can put patients at risk, especially vulnerable patients, such as the elderly; those with chronic conditions requiring oxygen, dialysis or other regular interventions; and those with mobility or communication impairments.

A continuity of operations strategy is an essential component of emergency management planning; while the goal of emergency management planning is to provide care to individuals who are incapacitated by emergencies, a continuity of operations strategy focuses on the organization. The goal is to protect the organization’s physical plant, information technology systems, business and financial operations, and other infrastructure from direct disruption or damage so that it can continue to function throughout or shortly after an emergency.

Strong continuity of operations planning lays a foundation for leadership decision-making regarding sheltering in place, closing services, or evacuating the organization. Even in situations where an organization leases or rents its space, the organization will need to coordinate with the owner(s) to determine the extent to which the organization’s essential infrastructure, supplies and equipment can be protected.

In light of disasters in recent months that have resulted in widespread disruption and extended periods of recovery, continuity of operations planning is essential for mitigating impacts to organization functions, staff and structures. The following recent events put health care organizations and patients at risk:

Chemical contamination of a municipal water supply threatened care to hundreds of dialysis patients, requiring ambulatory and hospital-based providers to coordinate quickly on immediate needs, and then on longer infrastructure solutions.
In the aftermath of wildfires, floods and other natural disasters, on-going roadblocks and damaged communication systems complicated home care agencies’ ability to deploy staff safely for essential home visits.
A ransomware attack at a large medical center compromised IT systems for two weeks. Laboratory and radiology had to manually write results and use runners between sending and receiving units, and pharmacy had to unlock automated medication dispensing machines and increase rounding.
Following a hurricane, an 11-story hospital in a remote community lost service to all elevators for over 24 hours. Staff and family members formed a human chain to move supplies, meals, and some patients up and down stairs until some elevator service was restored.
In the northern California wildfires, the largest health center in the community had a roof fire and sprinklers running for seven hours. Equipment, supplies and facilities were severely damaged by fire, water, smoke, and were vulnerable to looting due to the narcotics and pharmaceutical supplies that remained. Restoration of the facility is underway and is expected to take 12 months, impacting over 20,000 patients.
In communities that experienced repeated floods or fires in recent years, many health care workers left the area due to lack of available housing.

Best practice in continuity of operations planning includes, at a minimum, the following:

Continuity of facilities and communications to support organizational functions.
A succession plan that lists who replaces the key leader(s) during an emergency if the leader is not available to carry out his or her duties.
A delegation of authority plan that describes the decisions and policies that can be implemented by authorized successors.

Safety actions to consider:

After reviewing the initial survey results of The Joint Commission’s new Emergency Management requirements under the Centers for Medicare & Medicaid Services (CMS) Emergency Management Final Rule, continuity of operations planning has emerged as one of the issues that Joint Commission-accredited organizations need to address better in order to be more resilient during and after the occurrence of disasters and emergencies. Continuity of operations planning is a significant concern in community-based settings as well as inpatient settings, and the following actions can be applied to and utilized by any health care organization.

1. Succession and delegations: The organization’s documented leadership succession and delegations of authority should clearly indicate that successor individuals have been designated, and that the actions these individuals are authorized to implement are defined. These delegations will encompass internal decisions of the organization, and depending on the defined response activities, coordination of operations with the community’s incident command. In succession planning, the organization establishes and maintains orders of succession for key positions in the event leadership is incapable of performing authorized duties. The designation as a ‘successor’ enables that individual to serve in the same position as the principal in the event of that principal’s death, incapacity, or resignation. The organization establishes delegations of authority to provide successors the legal authority to act on behalf of the organization for specific purposes and to carry out specific duties. Delegations of authority will take effect when normal channels of direction are disrupted and will terminate when these channels are reestablished.

2. Essential functions: Identify the essential functions, capabilities, and assets that must be protected for the organization to survive a disaster. Examples include telecommunications, electricity, clinical records, and payroll. The table below provides a general illustration of how essential functions are addressed in continuity of operations:

3. Mitigation: Just as the organization must prioritize likely risks, it must also prioritize how it will invest in and implement mitigation activities. Organizations that expect to curtail or close operations for certain types of emergencies may emphasize mitigation activities such as advising patients in advance about pre-arranged alternative sources for care; securing equipment and supplies from damage or loss; establishing redundant systems to support payroll and other staff compensation procedures during the time of closure. Decisions regarding mitigation priorities should be considered in the context of prioritized risks and the organization’s role in community response and recovery.

4. Communications: Redundant technologies or procedures should be established in the event primary communication systems are compromised. Specific to continuity of operations planning, organizations should address:

How staff will know who they are to report to during an emergency when successors have been designated.
Process for communicating with the local incident command structure or other authorities having jurisdiction regarding their organization’s needs and/or abilities to assist the community.
For community-based settings in particular, the process for communicating with and supporting staff in conducting patient visits safely during disaster response and recovery
Process for communicating throughout response and recovery with suppliers and vendors to obtain or replenish critical medical or non-medical supplies.
How staff will be notified that the response phase has ended and the recovery phase has begun.

5. Recovery: Many organizations are well along in proactive planning for disaster recovery; those that are not can consider the following fundamental steps to move forward in the process:

Identifying individual(s) authorized to initiate the recovery phase and triggers for recovery.
Prioritizing recovery objectives in terms of the organization’s essential functions, capabilities, and assets.
Maintaining, modifying, and demobilizing its workforce according to the needs of the organization and its staff as it transitions from response to recovery (for example, being assigned to community shelters, and being part of a parent organization’s staffing plan).
Working with local emergency management, service providers, and contractors (either directly, or through a parent company, health care system or health care coalition) to prioritize restoration and reconstruction of critical building systems used by the organization.
Entering paper assessments or treatment records into the electronic system.
Maintaining and replenishing pre-incident levels of medical and non-medical supplies.
Working with local, regional, and state Emergency Medical System providers, patient transportation providers, and non-medical transportation providers to restore pre-incident transportation capability and capacity where relevant.
Working with local emergency management, service providers, and contractors to restore information technology and communications systems.
Preparing after-action reports, corrective action and improvement plans.

6. Alternate care sites: Continuity of operations planning requires the consideration of alternate care sites. Such considerations include: what selection criteria are used; type of services provided; the plan for staffing, patient safety and logistics (such as supplies, transportation, and communication); regulatory requirements; and who to contact in the local or regional incident command structure regarding the implementation of waivers if needed.

Integral to all of these safety actions, organizations should address:

Processes for obtaining/replenishing medical and non-medical supplies to inform decisions regarding continuation of services and to manage its supply chain integrity during response and recovery
Alternative means of providing critical utility systems if the organization plans to remain open and if needed to protect critical infrastructure during closure.
Procedures for evacuation – internal and external – that protect physical infrastructure, space, and equipment essential to critical functions and services.
Potential changes in workforce levels due to staff relocating from the area post-disaster; these relocations are typically intended to be short-term, but can become prolonged or permanent.
Implementing and testing continuity of operations plans in real-world situations so that staff can initiate procedures quickly, with confidence and clear communication. Power outages, IT failures or unscheduled downtime, brief loss of connectivity to telemetry, burst pipes — these are opportunities to implement and test components of the continuity of operations plan. Small structured drills (announced or unannounced) also help staff to test out the plans and become more nimble in their use. Post incident review (using a formal root cause analysis or similar procedure) will help identify areas in continuity of operations planning that require corrective action during minor incidents, thereby enhancing preparedness for major incidents.

Resources:

Administration for Strategic Preparedness and Response (ASPR). 2017-2022 Health Care Preparedness and Response Capabilities. U.S. Department of Health & Human Services, 2016, Pages 33-34.

Other resources:

Toner E, et al. A framework for healthcare disaster resilience: A view to the future. Center for Health Security, and Johns Hopkins Bloomberg School of Public Health, 2018.

ASPR. Healthcare COOP and Recovery Planning: Concepts, Principles, Templates & Resources, January 2015.

Federal Emergency Management Agency. Appendix 4: Continuity Planning Checklist. 2018 Continuity Guidance Circular.

Utility and IT systems

Stymiest DL. Planning for hospital utility failures and recovery: Assessing problem points and preparing a response to help comply with CMS regulations. Health Facilities Management, July 5, 2017.

Planning for water supply interruptions: A guide for hospitals and healthcare facilities. Healthcare & Public Health Sector Coordinating Councils.

ASPR TRACIE Technical Assistance: Generator Fuel Calculators.

Guidance for ambulatory facilities

CMS Emergency Preparedness Rule Toolkit: Ambulatory Surgical Centers. Wisconsin Department of Health Services, 2017, Publication P-01948E.

Guidance for home care settings

Home Care Emergency Preparedness: A Handbook to Assist Home Care Providers in Emergency Preparedness Planning. HCA Education and Research.

TRACIE Healthcare Emergency Preparedness Information Gateway. ASPR (see checklists on Pages 31-61).

Guidance for hospitals