When the Alexandria, VA-based American Academy of Otolaryngology-Head and Neck Surgery was ready to expand its business continuity plan to all of its operations and member services, it turned to Attainium Corp for expertise that wasn't available in-house. Attainium first conducted a Risk and Business Impact Assessment to identify The Academy's key processes and to prioritize critical safety and security issues.
Between preparations for Y2K and the heightened awareness resulting from the 9/11 terrorist attacks, the American Academy of Otolaryngology-Head and Neck Surgery had pretty much ensured the ongoing availability of its data with back-ups. "We had a false sense of security," said Dr. Neil Ward, deputy executive vice president for The Academy, "and we were aware that we hadn't leveraged technology advancements as well as we could." A year ago, The Academy found itself literally one inch of water away from back-up failure and realized their planning hadn't gone far enough. They also needed a contingency plan for their annual meeting in New York.
"Although we're just down the river from the Pentagon, I was particularly concerned that we have a plan in place for flood or fire, events which were more likely to occur than a terrorist attack. We felt that we hadn't really protected the staff as thoroughly as we should," Ward said.
The Academy's CFO, Tom Harlow, concurred. "We needed to ensure that our systems were safe and our operations would continue. In particular, we recognized the need to protect our greatest assets - our people."
Without enough inside staff or in-house expertise to do the job, The Academy turned Attainium Corp., a Gainesville, VA-based business continuity firm specializing in risk assessment, business continuity planning, and testing, training and evaluation. "They added a level of knowledge and understanding that we didn't have about business continuity," Harlow said. "They didn't give us the answers but guided us through the process. We made decisions we'd never entertained before.
"For example, we have a museum, which we needed to weigh in the context of our other operations. The Academy also maintains records for Continuing Medical Education for its members (10,000 otolaryngologist--head and neck surgeons who diagnose and treat disorders of the ears, nose, throat, and related structures of the head and neck) and is the primary source of education for otolaryngologists," Harlow said. "Our annual conference alone has 500 course hours, plus we offer a number of home-study packages."
"The Academy maintains a customized online database of Current Procedural Terminology (CPT) codes for its members, who need this information to complete their Medicare billings," Ward said. "We needed to ensure that these member services would remain available in the event of a disruption."
Attainium worked with The Academy's BiCePs (Business Continuity and Emergency Preparedness) Team to make the organization's 70+ employees aware of what was going on and to get their ideas. "We asked their top five concerns about personal safety in the workplace, then we used that to determine our priorities," Ward said. "The staff understood it was going to take effort to make this happen, and they were very much a part of the process. They understood we were doing everything we could, with Attainium's help, to ensure their safety and that their jobs would be there after any disruption."
Business continuity planning represents serious operational and financial commitment, "but it's a risk management issue - part of our risk management strategy - the same as insurance," Harlow said. "It's a sound business decision. For example, we just bought terrorist coverage for our annual meeting in New York - not because we think something will happen but because to do otherwise would be questionable business practice," he added.
"It's a cost benefit to the organization so we don't have a single point of failure. This is fairly easy to avoid on the system side, but, with a staff size that allows one person for one job, we needed to ensure knowledge/process continuity as well," the CFO said. "We're in the process of documenting our processes and procedures organization-wide and centralizing the information into a central database. This serves a business continuity purpose but also allows us to consolidate our customer service."
"Now that the plan is done, we are designating crisis managers for each of our three floors and we have purchased walkie-talkies for two persons on each floor," Dr. Ward said. "We also had our first fire drill in several years, and we're now accumulating shelter-in-place supplies if that becomes necessary for any reason."
"Our biggest ongoing concern," Harlow said, "is how to keep the plan alive and vital, how to test and update the document. The plan isn't the accomplishment… it's the beginning."
Dr. Ward agrees completely, stating that the next phase of the project is training, drills and testing with Attainium to create staff-wide awareness of the plan itself and to keep it up-to-date. "Working with an outside consultant really underlined to the staff our commitment for this project and gave it added importance."