[This is the final article from the premier issue of Prospective Risk Management In Healthcare. It is not available online. All disclaimers apply.]

Inadequate Y2K Planning Will Hurt

Take A Hard Look At Facilities' And Business Partners' Mission-Critical Roles

Risk managers seeking to prevent a morass of legal Year 2000 (Y2K) nightmares will improve their chances dramatically by stepping up the review process now--either internally or through an outside evaluator.

The Medical College of Georgia (MCG) in Augusta, for example, has a two-tiered system, said director of information services/Year 2000 project director Dwain Shaw. An independent, internal auditor, who reports to the senior vice president and president of MCG, "looks over my shoulder," he explained. The college's risk manager also serves as a second set of critical eyes.

Why the need for independent assessment of some kind?

First, in the event an injury or death results from Y2K, it's one more reasonable precaution the organization can point to. But more importantly, even healthcare organizations such as MCG that have consistently been working toward Year 2000 compliance for one or more years may fall short, especially in evaluating and planning for contingencies in two key areas: facilities and business partnerships or vendor/supplier relationships, explained Barry Wilkins, CFE, the CEO of Raleigh, N.C.-based Information Risk Group (IRG).

Wilkins' organization has performed independent surveys of 11 hospitals for a worldwide insurer. More than 70 percent of those hospitals would not have achieved Y2K compliance if they had continued on course with the compliance plans they then had in place. [Editor's note: Wilkins' firm has not assessed the compliance status of MCG.]

Wilkins said healthcare organizations need to focus on four basic areas of IT readiness:

-information systems and technology;

-biomedical equipment with embedded chips;

-the facilities; and

-the readiness of their business partners and external suppliers.

"What we found is that they focus on the top two because it's obvious, but the focus on the latter two has not been adequate."

Facilities include a wide range of areas, including elevators, heating systems, smoke detection systems, security access systems, pressurization systems and other plant-type functions. But the underlying lynchpin is basic infrastructure concerns.

Meeting infrastructure and other facilities needs will be a major focus of contingency planning at Roseville, Calif.-based Adventist Health System, said executive director of risk management and associate counsel Peggy Nakamura, RN, MBA, Esq., DFASHRM.

Problems Could Last Weeks

Healthcare concerns may believe that their typical disaster plans address most infrastructure issues. But those organizations may have a false sense of security, said Stephen Frew, JD, president of Rockford, Ill.-based Frew Consulting Group (www.medlaw.com).

Most typical disaster plans have one major deficiency in terms of meeting Year 2000 challenges, said Frew. "They're all predicated on the general assumption that outside resources will be available within 24 hours to augment their efforts, that it's a localized disaster." Citing examples of widespread natural disasters such as ice storms and hurricanes, hospitals need to prepare essential services to stand alone for a period of weeks, not 24 to 48 hours, he suggested.

For example, while most hospitals have standby power, such power often only goes to "a mere fraction" of a hospital's services. For Y2K, "they need to consider whether they could operate a week or a month with just the standby power or whether there are some areas that need to be added to the standby power capability," said Frew. Even with natural disasters, hospitals often run out of standby power outlets because they never anticipated how many they would need or in what locations, he noted.

Disaster plans also often rely on cooperation with other nearby hospitals. But "if it's a generalized Y2K problem, it's simply going to be that there is no available back-up," noted Frew.

What's The Worst That Could Happen?

Risk managers need to make sure that senior management is fully aware of the worst-case scenario in terms of potential infrastructure collapses involving the electrical power grid, telephone systems, water systems, sanitation and the like, advised Frew. "Then you can assess your capabilities incrementally as it progresses from no disruption to the worst-case scenarios of major infrastructure collapse."

Frew advised taking these steps:

-Find out what you already know from your existing efforts and your existing disaster plans.

-Establish a dialog with community leaders to determine your community's capability to continue to deliver essential services in the event of a Y2K crisis. This will require asking such pointed questions as:

*If power goes down, how long can you maintain city water to the hospital?

*If the facility is covered by a fire department and telephone lines go down citywide, what kind of protection or system can we put in place to provide fire coverage? And, with available water resources, if the power were down, can we fight real fires?

*How long can the sanitation system operate without backing up into homes and hospitals, and what are you doing to assure the system will remain functional?

-Categorize issues by whether they are short-term, medium-term or long-term, as well as whether they are minor, moderate or severe.

Each healthcare concern's senior management team should work to galvanize the community to address any infrastructure issues that are identified to ensure services will flow into the organization, said Frew. "The hospital will be the focus in the community, especially in nonurban environments."

Fewer Suppliers, More Y2K Risk

The other key Y2K failing of many healthcare organizations involves external business partners. Many organizations have spent the past few years outsourcing mission-critical products and services, and consolidating their business relationships among a diminishing number of vendors and suppliers, said IRG's Wilkins. These moves may have proved a cost-cutting boon, but they also are a potential disaster in terms of Year 2000 if healthcare organizations do not pay attention to the strategic partners at a detailed-enough level.

One hospital evaluated by Dennis Gallitano, JD, co-chair of the information technology law practice at Rudnick & Wolfe in Chicago, outsourced some information systems. "They were just relying on the outsourcer to say everything's fine, but everything wasn't fine," he said. "It turned out that the outsourcing firm had not upgraded its environment to make it Year 2000-compliant."

Likewise, IRG has seen cases where a hospital would write a generic letter to a strategic supply partner asking whether all of the products they bought from them were Y2K-compliant. "They would get a letter back saying yes, and it would list the products that are Y2K compliant," Wilkins said. But when IRG compared the supplier's list of what is compliant with the list of the products at the hospital, the hospital's list actually had noncompliant items, including some that were mission-critical, that the hospital wasn't planning to address.

Healthcare concerns should have at least one, if not several, backup suppliers for their mission-critical products and services, advised Wilkins.

Drugs, Disposables Are Critical

Pharmaceuticals and disposables are two critical areas in terms of patient care. Many healthcare facilities operate with a 24- to 48-hour supply of critical drugs, counting on just-in-time inventory replacement, said consultant Frew. Organizations need to assess their potential drug needs in a Y2K emergency period and establish some reserves in case of internal problems at the vendors or electricity, phone or transportation problems that could affect delivery.

Unfortunately, "their suppliers are going to resist them accumulating reserves, according to some testimony before Congress by the wholesale pharmacy organizations," he noted. Wholesalers, which in essence finance the drug acquisitions, are worried about inventory buildups eating into the bottom line, he explained.

Another critical business relationship involves disposables, commented Frew. Many healthcare organizations rely on disposable instrument packages. "When you run out of those, many [facilities] don't have an adequate supply of the reusable materials, nor an adequate sterilization process to deal with reuse of disposables," he said. "So they're going to have to look at either increasing the [disposable] stock on hand, having a means of sterilizing the reusables or having an adequate supply of reusable equipment."

-- Steve Hartsman (hartsman@ticon.net), February 19, 1999

Answers

Steve,

Many thanks for posting this series. Much appreciated.

-- De (dealton@concentric.net), February 19, 1999.

Thanks again, Steve!

... "Most typical disaster plans have one major deficiency in terms of meeting Year 2000 challenges, said Frew. "They're all predicated on the general assumption that outside resources will be available within 24 hours to augment their efforts, that it's a localized disaster." Citing examples of widespread natural disasters such as ice storms and hurricanes, hospitals need to prepare essential services to stand alone for a period of weeks, not 24 to 48 hours, he suggested." ...

Time to e-mail this link to a few people.

Leska, oh Leska!

Diane

-- Diane J. Squire (sacredspaces@yahoo.com), February 19, 1999.