UTHSC-H Business Continuity Plan Update

1. UTHSC-H Business Continuity Plan Update Moving towards “disaster resiliency” Jason Bible, MSM, ARM, CHMM Risk Manager The University of Texas Health Science Center at Houston 1851 Crosspoint Drive, OCB 1.330 Houston, Texas 77054 (713) 500-8100 Jason.p.Bible@uth.tmc.edu

2. Types of Disasters • Acute or evolving • Explosion or disease in community • Natural or man-made • Tornado or industrial chemical release • Intentional or unintentional • Terrorism or accidental building fire • Predicable or unpredictable • Hurricane or electrical blackout

3. Disaster Event Commonalities:A Recurrent Set of Discrete Stages 1. The pre-event stage 1 A. The forecast sub-stage 2. The event 3. The initial response stage 4. The assessment, hazard mitigation, and debris removal stage 5. The business continuity decision-making stage 6. The “return to normal” or “new state of operations” stage

4. Preparation and Response Elements Prevention Activities (in place) EH&S surveillance, training, Area Safety Liaisons program, drills, etc.

5. Preparation and Response Elements Prevention Activities (in place) EH&S surveillance, training, Area Safety Liaisons program, drills, etc. Emergency Response Plan (in place) ESRP

6. Preparation and Response Elements Prevention Activities (in place) EH&S surveillance, training, Area Safety Liaisons program, drills, etc. Emergency Response Plan (in place) ESRP Business Continuity Plan Although some elements exist, no consolidated and coordinated plan documented for HSC

7. Scope of Plan • Although the impacts of some emergencies can be felt for years, for the purposes of this plan, a 30 day window is considered to be most crucial • By 30 days post event, temporary fixes will be in place and assessments will be completed to allow for longer term decision making • This number is based on Tropical Storm Allison experience and other notable events

8. The Significance of 30 Days Tropical Storm Allison occurred on June 9-10, 2001. Houston Chronicle headlines 30 days later: 7/17/01 Hermann to reopen trauma unit http://www.chron.com/disp/story.mpl/storm2001/968409.html 7/18/01 Hermann and Baylor recovering http://www.chron.com/disp/story.mpl/storm2001/970234.html 7/19/01 Despite flooding, UH to start on time http://www.chron.com/disp/story.mpl/storm2001/971472.html

9. Other Validations of 30 Days • All Florida State Government entities are required to maintain COOP’s to cover a 30 day period • The London Train Bombings, July 2005: “although the London Underground network was closed all day, most of it was up and running the following morning and the entire network was back to normal within a month” • Addressing Lessons From the Emergency Response to the 7 July 2005 London Bombings Ried, J. Home Secretary and Jowell, T Culture Secretary UK Cabinet Office 22 Sept 2006 • The American Red Cross Temporary Shelter Planning Guide describes plans for operating for a 30 day period

10. The “Reasonableness” Factor • Impossible to plan for every contingency • Resource constraints limit scope of preparations as well • The “day job” doesn’t go away during all of this planning • Reasonableness strategy • Take an “all hazards” approach • Develop plans for key infrastructure services; ensure units are synchronized and play well together to get job done • Take a “bottom up” approach for front line units

11. Necessary institutional infrastructure (in rank order) UT Police Facilities IT/Communications Public Affairs EHS/Risk Management Animal Care Finance (procurement, billing, payroll) HR Medical billing Registrar Auxiliary enterprises Planning worksheets for local environments, by type Administrative units Research labs Clinics Academic endeavors Proposed BCP Strategy

12. Fig. 1. UTHSC-H Business Continuity Plan (BCP) Schema Necessary Institutional Infrastructure/Service Plans (eleven key units/services) BCP to contain highlight information for these ten key unit plans - each unit expected to maintain and execute detailed plan HR Aux Enterprise Facilities UT Police Med Billing Animal Care Registrar IT/Communications Pub Affairs EHS/RM Finance: Procurement, Billing, Payroll School-level Operating Unit Site Specific Plans (four main worksetting types) BCP contains templates for these plans to be completed and maintained by units within schools with assistance from EH&S/RM, ranked by revenue vulnerability

13. Focus on Vulnerable Revenue Streams • The BCP acknowledges that maintenance of revenue in times of disasters is crucial to continuity • Some revenue streams are more sensitive to emergency situations than others • The local unit BCP worksheets are intended to assist in this regard

14. 100% Time

15. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

16. Emergency Event 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

17. Immediate Impact on Clinical Revenues 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

18. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

19. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

20. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

21. Lagging Impact on Research Revenue 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

22. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

23. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

24. 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

25. Key BCP goal: reduce magnitude and duration of revenue loss 100% Designated Funds Clinical Practice, 39% General Revenue State Funds, 23% Contracts & Grants, 17% Local income, 6% Current restricted, 5% HCPC, 4% AE Funds, 4% Time

26. Successfully Addressing Disasters • Definition: “A sudden or great misfortune or failure” • But a key point that is absent is: disastrous to whom? • Consider the list of “retained losses” • all likely had “locally disastrous” consequences, but were never reflected in an “insurance loss run”, thus no systemic decisions made to intervene • The lesson here – “all disasters are local” • The good news is that the steps taken to address local disasters will work for larger disasters too!

28. And This is Likely Only the Tip of the Iceberg • Recent FBI data on computer theft: • “The theft of a laptop results in an average financial loss of $89,000; only a small percentage of the sum actually relates to the hardware cost.” • “Financial loss due to laptop theft has been second only to loss due to computer virus for the last seven years running.” • Source: 2002 Computer Security Institute/FBI Computer Crime & Security Survey

29. Addressing the Exposure:Example of BCP Intervention Strategy • Losses of frozen supplies or specimens • Can be a locally disastrous event • What can go wrong and how can we prevent it?

30. Failure Mode and Effect Analysis for Loss of Research Freezer Capability

31. Failure Mode and Effect Analysis for Loss of Research Freezer Capability X

32. Failure Mode and Effect Analysis for Loss of Research Freezer Capability Appropriate point of focus is here!

33. Possible Solutions to Freezer Vulnerability • Local preventive measures outlined in worksheet • Identification of surge capacity for freezer space? • Dry ice suppliers • Bulk pricing for freezer alarms that call PI directly? • Back up freezer capacity?

34. Completed BCP Steps • BCP text drafted by EH&S, reviewed by M. Tramonte, circulated to committee • Forwarded to Dr. McKinney proposed mechanism for executive leadership confirmation that 11 essential institutional functions have plans in place • Completed assembly of data for first ever retained loss summary –all noted perils interestingly covered on proposed worksheets • Assisted in procurement of BCP supplies for Animal Care, Auxiliary Enterprises, and Facilities, Planning and Construction • Coordinating installation of donated -80 freezer in MS to provide surge capacity in event of freezer failure

35. Completed BCP Steps • Exploring options for direct investigator notification of freezer failure • Met with MS DMO’s on 9/13/06 on research worksheets – completed forms discussed at follow up meeting on 11/13/06 • Met with Dianna Browning for initial review of clinic worksheet on 9/29/06 – initial response very positive. Group meeting with UTP on 11/11/06 - initial response very positive • Met with Dr. Buja to discuss academic issues 11/1/06 - initial response very positive • Met with SPH administrative leaders to discuss on 12/12/06 • Met with Mike Tramonte and associated business affairs administrative leaders on 12/13/06 to review approach

36. Completed BCP Steps • Met with M. Tramonte and received revenue and expenditures for departments across UTHSC-H • Met with Buddy Moore and received all assets related to research and clinical practice with a historic value over $10,000 • Met with the director’s from the Office of Research and discussed BCP issues related to research and administrative functions

37. Next Steps?