Business Continuity Case Study

Issue/Need
In preparing to address pending HIPAA requirements, a premier, multi-specialty physician organization based in Chicago was concerned that it wasn't properly prepared to recover from an Information Systems disaster. This group, which has a national reputation for providing top quality patient care, and supports the research and academic endeavors at a leading U.S. medical school and teaching hospital, knew it needed to develop a complete business continuity plan.

Objective
R&A analyzed and assessed the IS department's disaster preparedness, then developed recommendations on how to close the gap between its current state and where it needed to be to provide continued patient care and comply with HIPAA regulations.

R&A Role
R&A provided project management, leadership, mentoring, and knowledge transfer while assessing the IS department's readiness to deal with a disaster of any size, complexity or magnitude. In order to make the most viable recommendations, all clinical practices and business units were surveyed to identify the financial, operational and legal impacts an IS disaster would have on the organization's ability to provide patient services and what it would take to return to full operational capabilities.

Benefits
The IS organization learned what it could do to improve current operations as well as to better respond to a disaster. For example:

• Productivity improvements by changing the backup processes.
• Enhanced ability to prioritize their client projects—decisions now based on importance of systems (financial, operational and legal impacts) rather than the "squeaky wheel" syndrome.
• Learned how to mitigate impact and/or prevent certain disasters from happening.
• Identified ways to work smarter with adjunct partners (teaching hospital and medical school), such as working together to share costs for business continuity.
• Identified when they must "go it alone" to respond to a disaster.

Senior management was able to

• Shorten the decision-making and strategy-building processes by determining what options, presented through a cost-benefit analysis, were available to them.
• Lower the overall cost of business continuity by learning which business processes and corresponding information systems were most critical, thereby prioritizing decisions and future funding for mitigation, prevention, and response to disasters based on the impact analysis.