According to Dan Leong, director of emergency preparedness for the Kansas Hospital Association (KHA), the operative phrase regarding spend is "to the extent possible." He says, "The challenge for us in the rural agricultural states is that we don't have the type of redundancy that we need, because the hardware and things required to do that are huge costs for us as small regional hospitals."
To Cindy Samuelson, KHA has taken the lead in helping its local hospitals prepare. "We have six districts," says Samuelson, vice president for member services for KHA. "Everyone works together at the regional level, and we prepare at the state level as well." She says the recent Kansas tornadoes demonstrated that although the initial funds coming into the area were to deal with terrorism, it made more sense to focus on what's likely to occur. "We take a real team approach. Every hospital has a plan, and then every region has a regional plan, and then a statewide plan. So it's a three-pronged approach. The hospitals are coordinated regionally."
Bottomless hospitals
Generally the most secure place in a hospital depends on its layout, and though a basement is safer in a tornado, many small hospitals in Kansas are on just one level. The safest place for a server in that case is the interior of the hospital. The biggest challenge, however, according to Bill Mumford, corporate director of IT services, Kansas University Medical Center, is the capital for sustainability. "Many of the hospitals realize they have issues with disaster recovery, but it's hard when you're just trying to keep the doors open," he says. "Staffing is another big issue. In our smaller hospitals, the ED director may be the patient safety manager — they're all they wearing multiple hats. Many of the hospitals just don't have a dedicated disaster person. They're doing the best they can with the resources that they have."
Mumford adds that his organization tries to work through the hospital association. "There has been a decline in funding for us for disaster preparedness. It's hard for the hospitals to prioritize."
Though natural disasters may be more common in the Midwest, they are still difficult to predict. Jonathan Thompson of Healthia Consulting (Minneapolis) believes a core value in disaster planning is plan flexibility and adaptability.
"I think the emphasis is that you've got to start," Thompson says. "I think a lot of organizations assume that their existing plans — which may be SunGard (Wayne, Pa.) or a mirrored application platform where they can just cut over and recover — will cover them for their top number of critical applications, The challenge is that doesn't really extend out into all areas of the organization." He says the critical aspect of recovery is to identify your risks and to do the full business impact analysis early. "To do that in a thorough manner is going to be the make or break deal."
Tom Walsh of Overland Park, Kan.-based Tom Walsh Consulting agrees that a full analysis of business impact is key.
"What the business units think and what the IT department is capable of doing — there's a huge gap," he says. One of the common downfalls in the Midwest is that if a hospital is using a redundant system, it's generally located it in a facility that they own, and it's generally on the same campus, often a block and a half away from the main data center. "If you consider a tornado is usually 1.75 miles long, a block-and-a half won't cut it," he says.
The faster a department needs to recover, the more it's going to cost to maintain a high level of availability. Walsh feels the best approach is a hybrid one, where certain systems, usually clinical, must come up within hours. Financial systems can usually wait longer.
"With electronic payroll, worst case you can tell the bank, just duplicate last month's and we'll reconcile it when the systems are back up," Walsh says. He agrees that cost, especially for small Midwest hospitals, is a huge factor in recovery plans. "You have the physical environment, the HVAC, power, air conditioning; and that's all before you put your first server in the room. With two servers you've increased your workload."
Walsh says that one way to reduce that cost is the concept of virtualization. Virtualization allows you to take multiple applications that may be on different operating systems and put them all on one machine. The model is similar to the old mainframe concept of a multitasking machine.
"You reduce power consumption and space. Virtually, it looks like four machines but, in reality, it's one machine that's been divided. That's one way to reduce costs because it's very expensive to have redundancy."
How much redundancy is enough? Most experts agree that it all depends on the individual organization, its tolerance for risk and where it is in the lifecycle of migrating to a full EHR. "The key factor is where an organization is on the adopter curve — if it's ahead of the curve, the need for redundancy is very high," Thompson says. "There's a direct proportion between the amount of redundancy and the amount of technology, and a balancing act between what a system needs and what it can afford."
