What Is BCDR? How Health Systems Navigate Crises Using the Cloud

“It's a cascading effect, and that is a large hit to the bottom line for hospitals running on razor-thin margins,” he says. 

Even if healthcare organizations have not migrated their operations fully to the cloud, business continuity and disaster recovery (BCDR) is one area where the cloud can help.

For example, the Microsoft Azure cloud platform allowed Mount Sinai Health System to be better prepared for outage recovery through cloud-based geographic diversity and failover features. Meanwhile, Cook Children’s Health Care System in Fort Worth, Texas, migrated its electronic health records (EHRs) to the public cloud to gain more resiliency and be prepared for disasters or cyberattacks.

EXPLORE: Follow these best practices to improve cyber resilience in healthcare.

What Is BCDR?

“Business continuity and disaster recovery refers broadly to the process and steps organizations take to return to normal business operations in the event of a disaster or disruption. It is a key part of crisis management,” Nagaratnam says.

Business continuity plans are much broader and more proactive than disaster recovery plans, he adds. Disaster recovery plans are reactive and allow health systems to resume normal activity with systems intact after an outage.

In addition to downtime, failure to craft a strong BCDR plan can lead to data loss, financial penalties and reputational damage, Nagaratnam says.

While business continuity is the process of maintaining operations during a disaster, disaster recovery is the technical process of restoring connectivity after an outage, explains Al Berman, president of the DRI Foundation, a charitable arm of the Disaster Recovery Institute (DRI) International.

“The world does survive without technology for periods of time,” Berman adds. “We’ve seen that in hospitals, where hospitals continue to function despite the fact that they’re under ransomware.”

DISCOVER: How can healthcare organizations grow with a smarter backup strategy?

How to Craft a BCDR Plan for Healthcare

Health systems should come up with a BCDR plan for what to do at 12 hours, 48 hours and one week post-attack, Johnson advises. He adds that health systems need a plan that documents how to operate without their usual systems in addition to how to get back to a normal state. They can take lessons from aviation: Pilots are good at checklists, and they can deal with both a blown fuse and a loss of engines. Healthcare teams need a similar checklist in the event of a disaster, he says.

In addition, health systems should keep checklists for every department, workflow and critical area — including IT — to maintain processes, Johnson says.

Rajesh Sheth, vice president of AWS Elastic Block Store and backup at Amazon Web Services, advises that healthcare organizations incorporate a recovery time objectives and recovery point objectives in its BCDR plan. An RTO defines the maximum delay acceptable between service interruption and restoration, while an RPO describes how much data loss is acceptable between a service outage and the most recent recovery point. Healthcare organizations must decide on acceptable RTO and RPO thresholds for the organization.

Health systems should also analyze what it would cost to back up to a BCDR cloud, Berman advises, compared with a process like air gapping, which involves isolating a device from outside networks.

“It depends on how secure you want to be,” he says.

HER vendors and large tech companies such as AWS and Microsoft have multiple data centers throughout the country, which helps with redundancy during a disaster.

“The key is you have to have that connection,” Johnson says.

Crisis management teams should meet regularly to go through desktop scenarios and determine what happens at each decision point, Johnson recommends. Drill down and make the plans specific, especially for worst-case scenarios, he suggests.

Experts say stress testing is another key aspect of preparing for disasters and the recovery that follows.

“Restoration testing is the way to ensure processes will work when they are needed,” Sheth says. “By using services such as AWS Endpoint Detection and Response, customers can set up continuous, near real-time data replication to a staging environment in AWS.”

In addition, automation through Infrastructure as Code provides another way to reduce the time required to recover from a disaster, according to Sheth.

LEARN MORE: Backup as a Service can boost data protection. 

How Health Systems Use BCDR Solutions

As health systems get IT operations running again after a disaster, the cloud will be critical to helping them share information electronically. Services such as IBM Cloud Cyber Recovery provide cyber risk mitigation and an isolated, cyber-resilient infrastructure to prepare for ransomware and advanced cyberattacks. Meanwhile, the AWS Well-Architected Framework allows organizations to establish business continuity and disaster recovery objectives.

After a disaster or a cybersecurity incident, hospitals might find themselves back on paper. Lexmark’s Downtime Assistant lets health systems store medical records and forms in an encrypted storage device to prepare for massive downtime, Johnson says.

“If you do have to go back to pen and paper, we can store clinical information and downtime medical record documents on a device that can be a kiosk in the middle of a chaotic situation,” Johnson says.

A tornado occurred years ago at a health system Johnson was working at in East Tennessee. When a billboard came down and slashed the hospital’s fiber line, the organization used the Lexmark Downtime Assistant to print a checklist and documentation.

“Even if Downtime Assistant is plugged into a generator or on an uninterruptible power supply that machines can still work on, providers can print on demand everything they need to create a downtime record and keep taking care of their patients,” Johnson says.

UP NEXT: Discover how to increase your ransomware recovery capability.

Editor's note: This article was originally published on March 22, 2024.