Business impact analysis and recovery time objectives

Like the continuity of operations plan (COOP), business impact analysis and recovery time objectives are recommended team activities. It would not be inappropriate to use the same team as that developing the COOP, but other configurations could be considered. 

Related Article

Building a continuity of operations plan

The organization should develop standardized worksheets to evaluate the services to determine criticality and consider the recovery time objectives for each critical service.

Business impact analysis (BIA) is the first key component of determining recovery strategies and actions for critical services, as it determines which services are actually most critical to the organization. It is a process by which an organization determines how an event could potentially affect its business in the areas of operations, reputation, market share, ability to provide services, regulatory issues and more. In the evaluation, qualitative and quantitative impacts should be considered. 

Also included should be an identification of resources, such as personnel, equipment, infrastructure, technologies, information and supply chain, which would be critical management of the situation. Any limitation of management capabilities should be identified and factored into the impact on the critical services.

The second component is establishing recovery time objectives (RTOs). In general, this determines the point in time where the impact on the health care organization is unacceptable, such as loss of critical departments or services. These RTOs should be used to develop continuity and recovery strategies. For example, a shorter-term event could involve the use of alternate locations, whereas one of longer duration could involve relocation.

The assessment of BIA and RTOs defines the mission-essential services that must continue to be provided throughout an emergency, if possible. This exercise should be used to prioritize RTOs for all essential services. An example of the prioritization includes:

• Immediate: Life threatening or catastrophic impact to the organization.
• Four hours or less: Threat to life safety.
• Twelve hours or less: Impact on operations or patient satisfaction.
• Three days or less: Minimal impact or risk.
• More than three days: Nonessential.