Business Continuity Planning

1. Business Continuity Planning Presentation to LITN Mike Ouska, CIO - LSS of Illinois October 2006

2. Agenda • Terms • Justification for writing a BCP • BCP Content - What we do at Illinois • What do other agencies do? • BCP Testing – What we did at Illinois • What do other agencies do?

3. My Terms • Site Safety Plan • (prevention steps, fire drills, etc.) • Emergency Response Procedures • (during the emergency) • Disaster Recovery Plan • (recover computers & phones) • Business Continuity Plan • (resume business / service)

4. Justification - HIPAA • §164.308(a)(7)(i) – “… A Contingency Plan is the only way to protect the availability, integrity, and security of data during unexpected negative events. Data are often most exposed in these events, since the usual security measures may be disabled, ignored, or not observed.”

5. Justification - HIPAA • §164.308(a)(7)(i) continued – “…While the contingency plan standard must be met, we agree that the proposed testing and revision … should be an addressable implementation specification…”

6. Justification - Other • Learning Experience • Improves preparedness • Best practices • It doesn’t take a hurricane or a fire to knock a site out of commission

7. What LSS Illinois Did …

8. LSS Illinois has these sites… • 20 Senior Housing • 24 Behavioral Health Services • 21 Children’s Community Services • 3 Senior Community Services • 4 LTC + Market Rate Retirement • 4 Mixed / Other • 76 total sites, plus satellites

9. BCP Development - Illinois • IT created the template, the first BCP, and guidelines • Programs wrote the site BCPs (satellites exempt) • Accountability – theoretically correct vs. practical

10. BCP Contents • Identify Key Services • Prioritize Services • Resumption Approach by Service by Outage Length • … which drives staffing levels

11. BCP Contents

12. BCP Contents • Identify Contingency Site based on 30-day outage

13. BCP Contents • Facilities at Contingency Site • Office Space • Phones / Computers • Office Equipment and Furniture • Other (e.g., Transportation of Staff)

14. BCP Contents • Process Items • Organization of the Emergency Management Team • Responsibilities / Expertise • Response Assessment • Team Communication Process • Business Resumption Process

15. BCP Contents • Recovery Materials • Communication Items • Command Center • Call List • Employee Communications

16. Contingency Info Home Page

17. Contingency Info Site Employee Page

18. BCP Contents • Other Procedures • Expenditure procedures • Convening at Contingency Site

19. BCP Contents • Preparations for Return to Primary Site • Process for Return to Primary Site

20. BCP Contents • Maintaining Client Information • Accessing Client Records • Maintaining Confidential Records • Regulatory Requirements

21. BCP Contents • Maintaining the BCP • Testing the BCP

22. Contingency Info Site - Emergency Mgmt Team Page

23. What are other agencies doing for Plans?

24. Testing – What LSS Illinois Did • Conference Room Test • Facilitated by someone other than CIO • Test scenario unfolds as more information is provided over time • Participation of all Senior Management

25. What are other agencies doing for testing?