Continuity of Operations Planning Introduction & Practical Application Training for the Metro Foothills Healthcare Coalition Meeting May 3, 2016 Developed by Kelly Keenan, May 2015 Revised for the MFHCC, April 2016

Overview What is COOP? 10 Essential Elements Practical Application

What is COOP?

What is COOP? Continuity of Operations (COOP) Federal term for government and private sector continuity Continuity of Government (COG) Federal term for federal continuity Business Continuity Loosely defined term for private sector continuity

What is COOP? Continuity of Operations is the effort within organizations to ensure the performance of essential functions during a wide range of emergencies and events. Continuity of Government is a United States federal government initiative, required by U.S. Presidential directive, to ensure that agencies are able to continue performance of essential functions under a broad range of circumstances. Business Continuity (BC) is defined as the capability of the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident.

What is COOP? Continuity of Operations is the effort within organizations to ensure the performance of essential functions during a wide range of emergencies and events. Continuity of Government is a United States federal government initiative, required by U.S. Presidential directive, to ensure that agencies are able to continue performance of essential functions under a broad range of circumstances. Business Continuity (BC) is defined as the capability of the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident.

What is COOP? How an organization continues its essential functions during a disruptive incident.

History of COOP Throughout history Cold War Post-Cold War Fortresses Order of succession for a monarchy 1792: Formal line of Presidential succession was established Cold War Preserve the continuity of government in the event of a nuclear attack Post-Cold War Diminished perception of risk resulted in diminished value of COOP

History of COOP September 11, 2001 September 12, 2001 2001-Present Pentagon, federal government facilities in DC were evacuated September 12, 2001 Government regain operations, though Cold War policies limited some agencies from accessing their facilities. Shift towards “no-notice emergencies” 2001-Present Messy world of Federal Guidance 2007: National Security Presidential Directive-51/Homeland Security Presidential Directive-20 (NSPD-51/HSPD-20), National Continuity Policy 2012: Federal Continuity Directive (FCD) 1 & 2 2013: Continuity Guidance Circular (CGC) 1 &2 In the period following the end of the Cold War, attention to contingency planning reportedly decreased in response to the perception of diminished risk of widespread interruption to government operations as a result of an intercontinental nuclear attack. In the aftermath of the September 11, 2001, attacks on the World Trade Center and the Pentagon, federal government facilities in Washington, DC, were evacuated. The government resumed normal operations on September 12. As a result of that experience, some federal agency leaders recognized that if they were prevented from reentering their facilities for longer periods of time, existing contingency plans, based on Cold War era assumptions that included a period of warning before an attack, were inadequate protection in a threat environment characterized by potential sudden, localized terrorist attacks that could include the use of weapons of mass destruction. http://www.fas.org/sgp/crs/RL31857.pdf

Who is Responsible for COOP? Federal Government COOP Presidential Directive  Secretary of Homeland Security  FEMA State, Local and Private COOP According to FEMA, responsibility for continuity planning resides with the highest level of management of the organization involved.

Why Do COOP? FEMA asked nicely Emergencies disrupt normal operations, not demand Community Benefit Provide an essential function to the community Financial Lost revenue + extra expenses = reduced profits Customers defect to competition Ethical/Legal Should not abandon patients/clients/community Cannot abandon patients/clients/community

Alphabet Soup: COOP vs. EOP Emergency Operations Plans (EOP) Continuity of Operations Planning (COOP) Base plan. General and tactical guidance for managing the incident. Includes steps for addressing mitigation, preparedness, response and recovery activities. Part of the EOP Specific to organization’s operations. Focuses on extended incident response and recovery activities.

10 Essential Elements

10 Essential Elements or Continuity of Operations Capabilities Essential Functions  Orders of Succession  Delegations of Authority  Continuity Facilities  Continuity Communications  Essential Records Management  Human Resources  Devolution of Control and Direction Reconstitution  Tests, Training, and Exercises 

Essential Functions  A subset of government and other organizational functions that are determined to be critical activities used to identify supporting tasks and resources that must be included in the agency’s and organization’s continuity planning process.

Orders of Succession  Identified Orders of Succession are an essential part of a continuity program to ensure that personnel know who assumes the authority and responsibility if that leadership is incapacitated or becomes otherwise unavailable during a continuity situation.

Delegations of Authority Provide personnel with the authority to make key decisions during a continuity situation where the primary decision maker is not available. 

Continuity Facilities Alternate facilities from which an agency and organization can perform its essential functions in a threat-free environment.

Continuity Communications The ability of an organization to execute its essential functions at its continuity facilities depends on the identification, availability and redundancy of critical communications and information technology (IT) systems to support connectivity among key government leadership personnel, internal elements, other agencies, critical customers and the public during crisis and/or disaster conditions.

Essential Records Management The identification, protection and ready availability of electronic and hard copy documents, references, records, information systems, data management software and equipment needed to support essential functions during a continuity situation.

Human Resources Provides guidance to emergency employees and other special categories of employees who are activated by an agency and organization to perform assigned response duties during a continuity event.

Devolution of Control and Direction Capability to transfer statutory authority and responsibility for essential functions from an agency’s and organization’s primary operating staff and facilities to other agency and organization employees and facilities, and to sustain that operational capability for an extended period.

Reconstitution The process by which surviving and/or replacement agency and organizational personnel resume normal agency operations from the original or replacement primary operating facility.

Tests, Training, and Exercises Provisions made for the identification, training, and preparedness of personnel capable of relocating to alternate facilities to support the continuation of the performance of essential functions.

10 Essential Elements Essential Functions Orders of Succession Delegations of Authority  Continuity Facilities  Continuity Communications  Essential Records Management  Human Resources  Devolution of Control and Direction Reconstitution  Tests, Training, and Exercises 

Planning: Essential Functions Step 1: Identify the Essential Functions Step 3: Use the information in Step 1 & 2 to complete the COOP plan. Step 2: Understand the Essential Functions Identify and prioritize your Mission Essential Services. Research your Essential Functions Address the Essential Elements of COOP

Practical Application Essential Functions Identify Understand

Planning: Identify Essential Functions Step 1: Identify All Organizational Functions. Step 2: Identify Which Functions Are Potentially Essential. Step 3: Develop Mission Essential Function Data Sheets. Step 4: Prioritize the Mission Essential Functions. Step 5: Obtain Leadership Approval. Step 1: Identify Organizational Functions. To assist in accomplishing Step 1, useful resources may include the following: 1. Statutes, laws, executive orders, or directives that charge the organization with responsibility to perform missions; 2. Mission statements that describe the overarching mission(s) or list the services provided by the organization; 3. The organization’s strategic plan; 4. Published organization literature; and/or 5. Interviews with organization leadership and external partners. Examples of organization function descriptions are listed below: 1. Provide training to outside organizations; 2. Maintain and ensure operational capability of computer systems; 3. Provide Equal Employment Opportunity services; 4. Develop organization budget for the next fiscal year.

Planning: Identify Essential Functions Step 1: Identify all organizational functions. Define broadly May inadvertently include functions that are not essential. Define narrowly May result in too many functions to manage effectively. Examples: Provide training to outside organizations Maintain and ensure operational capability of computer systems Develop organization budget for the next fiscal year.

Planning: Identify Essential Functions Step 2: Identify which functions are potentially essential Determine if the function is: Mission or supporting activity Essential or non-essential

Planning: Identify Essential Functions Step 2: Identify which functions are potentially essential Mission vs. Supporting Activity If the function results in the delivery of service to the public or another organization, it probably performs a function that is a mission of the organization. If the function results in a service being delivered to another part of the same organization, it likely is a supporting activity. Supporting activities are typically enablers that make it possible for an organization to accomplish its mission.

Planning: Identify Essential Functions Step 2: Identify which functions are potentially essential Mission vs. Supporting Activity, consider: Statutes, laws, executive orders, or directives that charge the organization with responsibility to perform the mission/function. It supports to organization’s mission statement. It is part of the organization’s strategic plan.

Planning: Identify Essential Functions Step 2: Identify which functions are potentially essential Essential vs. Non-essential Essential functions have to be performed during emergencies. Non-essential functions that can be deferred until after the emergency. Consider: Interrupted for less than 30 days What is the impact?

Planning: Identify Essential Functions Step 2: Identify which functions are potentially essential Example: Fire Department Essential Non-Essential Mission Fighting fires is the mission of the fire department and cannot be deferred. Providing community fire prevention education is part of the mission, but can be deferred during an emergency. Supporting Activity Keeping first trucks operating is an essential support activity. Providing retirement guidance to fire fighters is important, but can be deferred during an emergency.

Planning: Identify Essential Functions Step 3: Develop Mission Essential Function Data Sheets For each mission essential function: Identify the function Describe the function Describe potential impacts if not conducted Select a recovery time objective E.g. A 6-hour delay in processing Social Security benefits may be acceptable, while a similar delay in restoring air traffic control operations is not. Identify the point of contact

Planning: Identify Essential Functions

Planning: Identify Essential Functions Step 4: Prioritize the Mission Essential Functions Objective and subjective process that should consider: Recovery time objective Smaller recovery time objective = higher priority Impacts if not conducted Larger impact = higher priority Management priority

Planning: Identify Essential Functions Step 5: Obtain Leadership Approval Organization’s leadership should review, validation, and approve: Mission Essential Functions Mission Essential Functions’ Prioritization

Planning: Understand Essential Functions Understanding the Essential Functions: Identify leadership needs Identify staff needs Identify community & IT needs Identify facility needs Identify additional resource needs Identify associate agency support needs *Essential Functions = Mission Essential Functions & Essential Support Activities

Planning: Understand Essential Functions Identify leadership needs. Does the essential function require senior leadership participation? Note: Not all functions will require leadership involvement. Example: The Director of Safety and Compliance must authorize entry of emergency workers into condemned buildings.

Planning: Understand Essential Functions Identify staff needs. What type of skills, and number of staff, is required to perform the essential function?

Planning: Understand Essential Functions Identify community & IT needs. What are the communication and IT requirements of the essential function? Note: Consider internal and external needs, type of capability required (data, audio, video), and level of secure communications or data management necessary.

Planning: Understand Essential Functions Identify facility needs. What type of facility is needed to perform the essential functions? Note: Consider primary and alternate sites.

Planning: Understand Essential Functions Identify additional resource needs. What additional resources are needed to perform this essential function? Examples: Office supplies Plans and procedures

Planning: Understand Essential Functions Identify associate agency support needs. What associate agencies is our organization dependent on to perform the essential function? Example: The hospital is dependent on their pharmaceutical supplier to provide antibiotics so they can treat infections.

Practical Application Orders of Succession

Orders of Succession Orders of succession outline who can, and should, assume leadership roles of the organization in the event an organization’s leadership becomes debilitated or incapable of performing its roles.

Example: Health Department Order of Succession Example: Health Department Role Title with the role 1st Successor (title) 2nd Successor (title) 3rd Successor (title) Lead the organization Executive Director Admin Director EHS Director CHS Director Prescribe medication for a mass prophylaxis response. Dr. Huffman (CHS Director) Lead the admin. division Admin. Director IT Supervisor EPR Supervisor Policy Expert Lead the environmental health division. EHS Supervisor #1 EHS Supervisor #2 EHS Supervisor #3

Practical Application Delegations of Authority

Delegation of Authority Ensure the orderly and predefined transition of leadership responsibilities within an organization during a COOP activation and are closely tied to succession. Succession = who Delegation of Authority = how

Delegation of Authority Example: Health Department Role Title with the role Delegate/Successor (title) Triggering Conditions Limitations Lead the organization Executive Director Admin Director Executive director is unable to complete the role (+24 hrs) Cannot provide policy recommendations. Can only serve for 14 days. EHS Director Executive director is unable to complete the role(+24 hrs), and the Amin. Director is unable or unwilling to serve as successor. Cannot provide HR guidance. Can only serve for 7 days. CHS Director Executive director is unable to complete the role(+24 hrs), and the Amin. and EHS Directors are unable or unwilling to serve as successor. Can only serve for 3 days.

Practical Application Continuity Facilities

Continuity Facilities Continuity Facilities includes other facilities and locations, and work arrangements such as telework and mobile work concepts. Allows the organization to relocate during an incident that impact their primary facility. Includes: Alternate Sites Telework Options

Practical Application Human Resources

Human Resources Staff is vital to the continuity capability of all organizations. Incorporate exist organizations policies and procedures into COOP: Communication, including initial alert and operations status Procedures for contacting and accounting for all staff HR Issues like pay, leave, work scheduling, benefits, telework, hiring, authorities, and flexibilities Procedures for assisting staff (e.g. disaster survivors) Training Personal Preparedness All staff have to either be essential or non-essential, based on: Essential function’s staffing requirements Leadership requirements

Human Resources Essential Staff Plan should address: Staff members that are needed to complete the essential functions must be considered essential staff. Plan should address: Pre-identify staff (by title) and training procedures Expectations, roles and responsibilities Cite existing organizational policies and procedures Contact information for essential staff Organizational policies and procedures support afterhours and overtime work Consider union and bargaining issues

Human Resources Non-Essential Staff Can be: Staff members that are not needed to complete the essential functions must be considered non-essential staff. Can be: Reassigned to participate in other response activities E.g. ICS, Reconstitution Team Continue to complete their normal tasks Furloughed

Practical Application Essential Records Management

Essential Records Management Identify, protect, make availably essential records “Essential records” support the continued performance of essential functions during an incident. Includes: Information systems technology Applications Infrastructure Electronic and hardcopy documents References and records

Essential Records Management Essential records fall into two categories: Emergency Operating Records E.g. Emergency plans and directives, orders of succession, delegations of authority, staffing assignments, and related policy or procedural records. Rights and Interests Records E.g. Accounts receivable files, contracting and acquisition files, official personnel records, Social Security, payroll, retirement, and insurance records, property management, inventory records

Essential Records Management Plan should address: Complete inventory of essential records. Includes records that: Specify how an organization will operate in an emergency or disaster Necessary to the organization’s continuing essential functions and resumption of normal operations Needed to protect the legal and financial rights of the organization and the public Essential records and database risk assessment Identify the risks involved if essential records are retained in their current locations and media, and the difficulty of reconstituting the records if destroyed Essential records plan packet

Practical Application Continuity Communications

Continuity Communications An organization’s ability to execute its essential functions depend upon the availability of effective communications systems. Communication necessary for the essential functions Communication necessary for senior leadership to Collaborate Develop policy and recommendations Act under all-hazards conditions The COOP plan should address all of your communication needs, and how those needs will be meet and sustained during COOP activation.

Continuity Communications Type of Communication Internal Communication External Communication, Associates External Communication, Public External Communication, Other Method of Communication Land Line, Cell Phone, Text Message, Fax Email, Computer, Network access, Internet EMSystem, CO-SHARE, WebEOC, CEDRS, Health Alert Network 800 MHz Radio, Satellite Phones, HAM/Amateur Radio Operators (ARES) Secure Communication Data Management Needs

Practical Application Devolution of Control and Direction

Devolution of Control and Direction Devolution planning supports overall continuity planning and addresses events that render an organization’s leadership and essential function staff unavailable or incapable of performing its essential functions from either the organization’s primary operating facility or alternate sites. Devolution is a continuity of planning element that may not be appropriate for every agency. Transferring operations: Different location within an organization Different individuals within an organization An outside organization

Devolution of Control and Direction The Devolution section of the COOP plan should address the following elements: Identify which essential functions the agency would transfer Resources needed transfer to the devolution site Resources needed perform at the devolution site Activation protocols (triggers) How, and when, operations will transfer Points-of-contact (POCs) at the devolution site(s) POCs with responsibility for personnel who will perform the essential functions Acquire resources necessary to continue and sustain operations Restore or reconstitute organization authorities

Practical Application Reconstitution

Reconstitution Reconstitution addresses how the organization will return to normal operations once leadership determines that the actual emergency, or the threat of an emergency, is over. Process of reconstitution begins at the start of a continuity event. COOP should include a reconstitution team to help the organization resume normal operations as quickly as possible.

Practical Application Tests, Training, and Exercises

Tests, Training, and Exercises Testing, training and conducting exercises is necessary to assist organizations to prepare and validate their continuity capabilities and program and ability to perform essential functions during any emergency. Once completing the COOP plan, COOP should be built into your larger Training and Exercise Plan.

Questions? Contact Janelle Worthington at Jefferson County Public Health at jworthin@jeffco.us or Cali Zimmerman at Denver Public Health at cali.zimmerman@dhha.org