Business Continuity Disaster Recovery

1. Business ContinuityDisaster Recovery Are You Ready??

2. Definition of Crisis Management Planning • “The advance planning and preparations which are necessary to minimize loss and ensure continuity of the critical business functions of an organization in the event of a disaster.

3. Preparing for Disaster: A Toolkit to assist preparing to respond to a crisis • Today's Objectives: • Identify and prioritize areas of risk for your business • Select a compilation of forms to start your own plan • Create an employee calling tree, key contacts forms and critical patient list • Prepare a “test” for your plan

4. Business Impact Analysis • Financial risk (of loss) and what your organization can withstand need to be defined separately. Consider a formula that extrapolates hours to days • How long is your average patient willing to wait for your business to be restored? • BIA includes a thorough stress test of back up, restoration and interdependency (V/D) processes for critical applications

5. BIA - more You need to: Identify points of failure in your network Identify need for robust voice/data restoration Identify how “Reputational loss” will affect your business

6. BIA – 10 top questions to ask • 1. What are your most critical business processes? • 2. If those systems were no longer available, how would you function? • 3. How do you currently mitigate risk of compromised IT systems? • 4. What is your recovery initiation process for compromised or destroyed systems? • 5. How will employees respond to a catastrophic event if your business is evacuated?

7. Top 10 - continued • 6. If you are no longer able to access your office, how will you restore critical functions? • 7. If you face a disaster scenario, what is your communication process to employees, authorities, etc.? • 8. Do you have policies/procedures established to keep your company in business post-disaster? • 9. Do you have measurable benchmarks for effective response, recovery and restoration programs?

8. Top 10 – not the least • 10. Do you test (and how often) your BCP? Do you know where to find those results? TEST!! TEST!! TEST!! TEST!!

9. Business Impact Analysis Key Points • Clearly define critical business and restoration processes • Strategize BCP by reviewing current operational service levels • Identify personnel responsible for determining BCP launch • Confirm authorization and security access for launch and restore personnel • If a building is evacuated identify alternate site needs or telecommuting standards

10. Key Points BIA….. • Can you service your patients from an alternative location or a similar (non-competitive) business? Think out of the box • Utilize industry standards to guide decision to launch BCP or determine functional status • DO NOT SKIP TESTING!!! • Study and repair routine test results and deficiencies • Disasters should not be used to fix known problems

11. Testing Validation • Define roles/ responsibilities by abilities/skill • Designate subject matter experts for efficient recovery • Plan testing is critical • Use DR plan for small outages • Be aware that some accrediting bodies now require plan drills, i.e., Joint Commission • Testing identifies DR deficiencies

12. Your to-do list… • Assemble a small team of management from your organization • Review each of the six short chapters in the Toolkit and review the material within: • www.hmehurricane.com • Download and print the Toolkit and complete the worksheets • Spend some time discussing your company’s response to a prospective crisis

13. Risk Assessment • Consider what kind of likelihood a risk poses to your business or area • Consider what severity level you feel that risk would pose to your business • Based on your analysis, determine which risks merit a significant part of your focus/plan • Consider setting those priority items as risks that you’ve determined to be reasonably possible and which have a medium or high severity to your business

14. #1 - Insurance

15. Insurance • Meet with your insurance provider annually to review current coverage for such things as physical losses, flood coverage and business interruption. • Exception: If you are substantially growing, review coverage for property and liability more frequently.

16. Insurance • Consider how you will pay employees and creditors in the event of a business interruption • Business Income/Business Interruption/Loss of Income riders frequently are included in property policies (e.g. $25,000) • Additional increments may be purchased for relatively low amounts (e.g., $50K for $100)

17. Insurance • Plan how you will provide for your income if your business is interrupted • About 1/3 of current VGM Insurance Inc. customers carry business interruption/loss of income insurance • Actual Case: First Call Pharmacy (New Orleans) relocated operations to Houston. Moving, loss of income coverage: $100,000.

18. Insurance • Find out what records your insurance provider will want to see after an emergency and store them in a safe place • Keep a copy of your insurance policy/policies offsite and include a checklist for insurance coverage in place and a form to record insurance policy information • Understand what each policy covers and what it does not

19. Insurance – Things to think about • Standard Commercial Property Insurance policies cover fire and theft on premise. Various provisions restrict coverage in insurance policies. Read the entire policy carefully to determine your rights, duties and what is and is not covered.

20. Insurance – Things to think about • HME providers’ equipment that is out in patients homes is not usually covered under a Standard Commercial Property policy unless an Equipment Off Premise endorsement is purchased. Equipment off premise provides limited protection for insured property while temporarily at a location not owned, leased or operated by the insured.

21. Equipment Off Premise “Inland Marine” • Depending on the area, some insurance companies include the endorsement within the property policy • Some companies will not write the endorsement in flood plains • Check with your agent!

22. Perils normally excluded from Standard Policies • Flood – 75% of disaster declarations result from natural phenomena in which flooding was a major component. If you are unsure, you can find out if you live/operate in a flood prone area from your state emergency management office or Red Cross chapter

23. Perils normally excluded from Standard Policies • Individuals and business owners can protect themselves from flood losses by purchasing flood insurance through the National Flood Insurance Program (there is normally a thirty day waiting period before a new policy becomes effective). Most commercial property policies exclude flood.

24. Don’t “Under-insure” • Review your buildings and contents coverage • Penalties were applied to many HME providers affected by the disaster for “under-insuring”. Generally, most policies required the providers to purchase property coverage at 80% of “in-house” assets (inventory, furniture, fixtures, office equipment, etc).

25. Other Perils • Earthquake – Coverage for earthquake damage is excluded in most property insurance policies. If you are located in an earthquake-prone area, you’ll need a special insurance policy or commercial property earthquake endorsement • Wind/Hail – Coverage for wind and hail is typically excluded in the coastal regions. If coverage exists, usually a deductable applies; this will be explained in your policy wording.

26. Conclusion • Every policy has different variations of coverage • Get educated regarding your insurance policies. Don’t wait to find out if you are adequately covered…it may be too late! • John Spragle, President, VGM Insurance: “Read your Dec (declaration) Page! If you don’t understand what’s covered and what isn’t, call your agent!”

27. # 2 – Ongoing Operations

28. Triage of Critical Patients • Of course, one of the most important functions of the HME recovery process is providing ongoing care to your critical patients • Identifying these patients by category (e.g., patients on ventilators, mobility challenged patients, oxygen patients) should be done before an emergency happens.

29. In a follow up with HME providers, virtually 100% of them maintained patient lists, which included emergency contact, diagnosis, physician/contact information, HME equipment, settings and back-up equipment information. • However, less than half were up to date…many inaccuracies especially in current addresses were noted.

30. As you identify patients by diagnosis category, you need to assess what resources you need to have to provide ongoing support. Also, it is important where these resources are. Perhaps the most important is…

31. Your Gas Supplier: • Ensure that your oxygen supplier has a generator! • Have emergency numbers to contact them (cell phone, pager, answering service, home numbers).

32. From a VGM member: • “This saved us because cell phones, answering services and pagers were done. I was able to reach the General Manager at his home. He was able to contact his employees to help us with liquid base units. In our case, our gas supplier did not have a generator and could not transfill. He did give us all of his liquid base units and “H” cylinders (used as backups). An “H” cylinder full lasts approximately 57 hours on 2 liters.”

33. Have a backup gas supplier • Ensure that the backup supplier has a generator and will come to your aid in a crisis situation. • From another member: “ I happened to know a supplier in our area and he was ready if we needed him. It is very important to requote your business when your contract is up. You truly do make contacts and during a crisis this will separate the best from the average companies.”

34. Generator: • Ensure your generator can power your facility. • “We had lights and phones within 1-2 minutes after the blackout. This saved us because our answering service could not handle our calls. We ended up spending the night to ensure our patients were taken care of.”

35. Generator • Even though your HME has a generator, it may not power your computer (e.g., surges, etc). Have a current hard-copy list of oxygen patients, and prioritize contacting those patients without backup oxygen cylinders.

36. Gasoline Supplier: • Ensure that your gas supplier can manually pump gasoline. • Many diesel suppliers will be OK, but most HME vans run on gas.

37. New Policies: • All trucks must fill up at then end of the day (versus in the morning) • Locate a gas station that can manually pump gas in an emergency • Contact the city that your company resides in, trucking firms, oxygen suppliers, apartment complexes and see if they have a gas pump on the site that you could utilize during an emergency.

38. Miscellaneous: • Bottled water and snacks on site for your staff • Flash lights • Extension cords • From another member – “Most importantly, have someone in charge that can direct and keep people calm. It was truly a challenge when it was not long after 911 and without notice our communication to the world stopped. Someone needs to take control and have a calming affect until you really know what you are dealing with.”

39. Billing Capability • An HME’s ability to continue as an ongoing business is usually contingent upon the ability to bill Medicare and other payer sources. • As part of your planning process you must evaluate how you’re going to continue billing in the event of a disaster.

40. We found that HME’s using Internet based billing systems or billing services were better prepared to continue billing. • What percentage of members of audience use Internet-based systems? Outside billing services. Input on advantages or disadvantages?

41. Billing Capability • CMS has created the following new condition codes and modifier (effective 8/12/2005): “DR (Disaster Related)” and “CR (Catastrophe/Disaster Related)”. • For more detailed billing information and FAQs go to: http://www.hmehurricane.com/

42. Payroll Payroll continuity is key to continued loyalty of your employees, so make sure your planning addresses your on-going ability to pay employees. It helps them handle disaster-related problems at home and meet their personal financial obligations.

43. Disaster Bonus • “At the time we did not have a bonus structure in place for emergencies. Our employees rose to the occasion. I was extremely proud of them for going above and beyond. After the blackout, we instituted a bonus plan and paid employees a bonus. We had a luncheon meeting and presented all employees with the bonus. It went over so well. I really have to say it was one of the most moving moments for me. These people love and care for our patients. We even serviced patients that were not ours, just because we are who we are.”

44. #3: Internal & ExternalCommunications/Public Relations

45. Internal Communication • One of your most valuable assets is your employees. In the event a disaster occurs, you need to protect yourself and your staff. You also have to consider the possible impact a disaster will have on your employees ability or desire to return to work.

46. Advanced Planning Steps • Create and maintain an employee contact list with current address and phone numbers for each person on staff. • Create a “calling tree”. Use your employees contact list to fill out a calling tree. Maintain and keep this in an accessible location. Also make sure a copy is offsite. The person designated as “primary” on the tree should be the one responsible for the tree and for calls by fellow employees.

47. Actual Scenario: • Virtually 100% of HME providers had developed call tree procedures. Copies were in offices, vans, homes, on-call vehicles, etc. • When asked the last time the “calling tree” procedure was tested, responses ranged from “never..we made one for JACHO”, to “a few months ago”. • Select a day in the near future and TEST!

48. Transportation and Housing • Have you considered the need for alternative forms of transportation for employees? Rental vehicles? • You need to be prepared if a disaster occurs and your employees don’t want to return to the area. You may need to consider issues such as alternative housing options and ways to replace the knowledge base lost if employees don’t return to work.

49. Store a hard copy of your vital information such as your employee data and payroll in a fire-proof box off-site. Some experts recommend at least 50 miles away. Make it a critical part of your routine to regularly back up your personnel and payroll files • More companies are using internet based back up companies who routinely back up critical information. Then the information is readily available from any internet ready source.

50. External Communication • Planning is required so that when a disaster or emergency occurs, inquiries from the news media, patients, referral sources and staff can be handled effectively. It is easier to compose communications in advance, with time to think, than it is in the face of a crisis.