On July 19, 2024, the infamous CrowdStrike outage impacted 759 hospitals in the United States. A forensic analysis examined almost 1,100 internet-dependent services that were impacted by the attack.

Unfortunately, a full 21.8% of the issues directly affected patient care.

The effect of disasters on healthcare IT is undeniable. Even when an incident only affects appointment systems or documentation processes, the interruption hinders your ability to serve patients and support revenue.

Here’s a checklist you can use to assess whether your healthcare organization is ready for a disaster—and identify gaps you need to address.

Your Healthcare Disaster Recovery Checklist

By going through the following list, you can determine how strong your disaster recovery system is and pinpoint ways to make it more effective.

1. Define Critical Systems

Your team has to agree on which systems are the most critical, which include all that need to stay online to support patient care. These often include systems such as:

• Electronic Health Records (EHRs)
• Imaging labs
• Scheduling
• Communication tools

To illustrate, your care team and IT team may have a meeting to discuss the most business-critical systems in your organization. They choose to organize important systems using a simple stratification framework.

Tier 1 systems are those that you absolutely need to safeguard in the event of a disaster, and they may include:

• Medication administration records
• EHR
• Lab results
• PACS
• Interface engines

Other systems, such as billing, are also critically important—but they can likely be offline for a period of time without compromising your ability to serve patients.

2. Document What to Do if There’s Downtime

Your IT and clinical teams need to know what to do if a system goes down. In some situations, paper-based workflows can take over, such as manually writing and filing prescriptions. In all cases, your teams will have to follow some sort of backup or recovery procedure.

It’s also critical to decide how events get escalated as they unfold. This way, if a core system goes down, stakeholders know who to contact and when.

For instance, your nursing team needs to know where you store paper charting forms and how to record the administration of medications manually. They also have to understand who to notify if a system goes down, as well as when it comes back online.

3. Decide Which Data to Back Up, How, and When

Patient data needs to be automatically backed up on a regular basis. But you also have to choose which apps and configuration settings you need to back up to ensure you can restore operations as quickly and smoothly as possible after a disaster. Using a backup as a service (BaaS) solution streamlines these decisions and makes it far easier to implement an effective system.

While some backup decisions are going to be very business-specific, here are some that healthcare organizations often select:

• Patient records
• Imaging data
• Clinical applications

Typically, it’s best to automatically back these and other systems in accordance with your RTO/RPO policies. That way, if there’s a disaster, the previous state you return to is relatively recent.

4. Test Your Backup Plan

By periodically testing your backup system, you confirm its reliability and can spot any deficiencies before they hurt your resiliency.

For example, suppose your clinician team recently implemented a new patient management system. Your existing backup procedures may not include backing up this app or its data. A periodic review and test would reveal this discrepancy.

5. Agree Upon Recovery Time Goals

Your IT and clinical leadership teams have to decide how long critical systems can be down before their absence starts impacting patient care. You then use these time frames as guidelines for setting your priorities.

For example, you may decide that your EHR needs to be available within 90 minutes or less. But your billing system can be down for as long as 12 hours. When you define these boundaries, you can present them to disaster recovery as a service (DRaaS) providers so they can build the best solution for your site.

6. Ensure Employees Have Secure Access During a Disaster

If you must shut down some systems during a disaster, it’s often best to allow access for some authorized individuals. This may include systems used for managing patient charts or data from IoT devices, like machines that monitor vital signs.

For instance, let’s say during a suspected cyber attack, your team decides to prevent access to all core IT systems. To avoid impacting patient care, the hospital may decide to:

• Switch to downtime procedures
• Use downtime viewers
• Rely on read-only copies or DR environments

By carefully vetting who’s allowed access, you can greatly shrink your attack surface while still insulating patient care from the effects of an attack.

7. Include Cyber Attacks in Your Disaster Risk Portfolio

You should always account for ransomware, malware, and insider attacks as you build your disaster readiness system. While a power outage or flooding could certainly have a significant impact, the effects of a cyber attack can be just as disastrous.

Once you’ve identified the types of attacks you’re going to prepare for, decide on standard operating procedures for each one.

For instance, after a ransomware attack, your IT team may have to restore systems from clean, recent backups made prior to the incident. This means they first have to verify the integrity of these backups and practice implementing them while under time constraints.

8. Clearly Define Roles and Responsibilities During a Disaster

You should establish a leadership team to call the shots during a disaster. It might consist of someone from IT, someone from operations, and a clinical manager. You also need to specify what everyone else has to do.

For example, you can require nurses to check the systems impacted by the event every 30 minutes and report any findings. If you have a DRaaS solution in place, you can coordinate with that team to decide who should do what. If you have BaaS healthcare cloud solutions, your DRaaS team may be able to manage much of the restoration process on its own.

You also need actors on the scene who are ready to perform physical actions. For instance, someone from the maintenance team may have to check the operation of a backup generator once every hour to make sure it’s not in danger of being overloaded.

9. Periodically Review and Adjust Your Plan

Tools and workflows change all the time in healthcare, so you have to regularly audit your systems and make sure your disaster readiness can support your continuity. This should be done at least once a year, but also:

• Whenever you add new software to your stack
• Anytime you change your healthcare cloud solutions provider
• Whenever someone from your disaster response team leaves your organization
• Before and after any merger or acquisition deal

Benchmarks like mean time to recovery (MTTR) make it easier to quantify the effectiveness of your readiness system from one review to another. If MTTR or other metrics are hard to meet during a test and review, you may have to make significant adjustments by:

• Providing additional training to those responsible for spinning up backup or parallel systems
• Adjusting the service level agreement (SLA) with your DRaaS provider to ensure speedier recovery times
• Adding an employee to fill a gap or assigning an existing employee an additional disaster-specific role
• Either way, your entire team should embrace the review process because it’s a great opportunity to reduce risk by identifying weak points.

Healthcare Disaster Readiness FAQ

Q: Do we need to involve clinical teams in our disaster recovery planning?

A: Yes! Involving clinical teams is important because they have a deeper understanding of the systems that play the biggest role in their day-to-day workflows. Clinicians can also play key roles in your incident response plans, so getting their input in the development process can be very helpful.

Q: How often should we test our recovery plan?

A: You should test your disaster recovery plan at least once a year. It’s also important to set aside testing time after you make changes to your digital infrastructure, such as adding new software or transitioning a legacy system to one that works well with your healthcare cloud solutions.

Don't forget to update your plan anytime a member of the disaster recovery team leaves your organization or you onboard a new team member.

Q: How are backups and disaster recovery different?

A: Backups only protect data. Disaster recovery keeps entire systems and workflows secure, making sure you can restore them when needed. A disaster recovery system often involves backups.

Q: Can managed services help with our disaster readiness?

A: Yes, a managed services provider like RapidScale can make your disaster recovery prep easier, faster, and smoother. Cox Business understands what healthcare organizations need to do to protect their most vital systems during a disaster and has healthcare experts experienced with architecting effective DRaaS solutions.

Strengthen Your Disaster Readiness with Expert Support

Send our team a message today to learn more about how RapidScale can help strengthen your disaster readiness. Our team is here to support your organization as you build a more resilient and prepared infrastructure.