Minimum Viable Hospital: Establishing Your Baseline for Clinical Continuity
The concept of a minimum viable hospital represents the most critical functions that healthcare organizations must have to provide clinical continuity.
To determine its own minimum viable hospital, a healthcare organization must identify the roughly 30 to 50 applications it needs to keep delivering patient care during an outage. These might include apps that schedule patients into hospital rooms, order labs or surgical supplies, and pay employees.
When building its minimum viable hospital, Franciscan Health, a 12-hospital health system in Indiana and Illinois, evaluated more than 100 applications that integrate with its electronic health records and pared that list down to about 60.
“These are the applications required to be minimally viable in a clinical setting,” says Charles Christian, vice president of technology and CTO at Franciscan Health.
A minimum viable hospital also should involve identifying the tech-dependent healthcare procedures, such as advanced cancer treatments, for which paper-based processes are simply insufficient.
READ MORE: Follow this five-step action plan for achieving clinical care resilience.
HIPAA Compliance and Patient Data Protection During a Disaster
Healthcare organizations need to know where all their patient data lives so that, during a cyberattack, they understand the full extent of the breach. They can’t wait until an attack to discover, for instance, that some employees have been exporting certain patient data sets.
“Healthcare organizations need to get a handle on where their overexposed sensitive data is,” Howell says, noting the federal Cybersecurity and Infrastructure Security Agency’s principle that “you cannot protect what you cannot see.”
With 360-degree vision into its patient data, a healthcare organization knows which patients to notify if attackers compromise its systems. As a result, “it’s easier to comply with HIPAA and notify the right patients,” Howell says.
Building a Healthcare BCDR Plan That Covers Key Clinical Workflows
For healthcare organizations, a business continuity and disaster recovery plan has one overarching goal: continuing to serve patients.
To achieve that, a BCDR plan must cover the key clinical workflows. “The hardest part about resilience and business continuity is the workflows,” Christian says.
Significantly, a BCDR plan documents what employees need to do when technology goes down, Christian notes. For instance, clinical staff need to know how to use whiteboards to track patients or how to use paper forms to submit lab orders.
In addition to being documented, the BCDR plan must be tested. That’s especially critical when many healthcare employees have never provided care without technology. “They need to know how to operate while we’re working to get the network back up,” Christian says.
The BCDR plan also should establish the recovery time objective and recovery point objective. The RTO is the maximum length of time it should take to restore normal operations following an outage, while the RPO is the maximum amount of data an organization can lose. Franciscan Health’s target RTO, for example, is 72 hours.
