1. 1 The process of analyzing all core business functions and establishing an optimized timetable for recovery. Provides baseline for:  Justification for costs associated with recovery.  Developing recovery strategies.  Developing Support Level Agreements Business Impact Analysis  Maps data flow  Identify maximum tolerance for downtime.  Identify interdependencies.  Determine the recovery priorities of the organization.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

2. 2 End-User Questionnaire Highlights:  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis Business Impact Analysis  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

3. 3 Department Overview  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis 1. Identify department, location, and at least two representatives from each department. 2. Develop a comprehensive list of applications used in the department. 3. Describe the business function(s) of the department. 4. Gather information about the department’s daily business hours, revenues generated, transaction volume, and any peak or high demand periods.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

4. 4 Workflow Interdependencies  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis 1. Identify the departments and organizations that send work to the department. 2. Determine what routes or channels of communication are used to send that incoming work and estimate the percentage that comes via each route or channel. 3. Gather the same information in #1 and #2 for work sent by the department.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

5. 5 Sumber Daya Komputer  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis 1. Gather information on the computing equipment in the department and how it is used. 2. Begin exploring the reliance that the department has on the computing equipment, e.g., What data entry backlog would there be if it was unavailable for one day?  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

6. 6 Application Impact Analysis  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis 1. Basic description of each application, including what it does, what business functions it supports, if it handles PHI, and who the department contacts are for the application. 2. Estimate the level of departmental business interruption associated with the application being unavailable through various time thresholds. 3. Estimate the associated data entry backlog that would result and how many staff hours it would take to eliminate the backlog.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

7. 7 Application Impact Analysis  Department Overview  Workflow Interdependencies  Computer Resources  Application Impact Analysis 4. Evaluate the downtime procedures associated with the application, asking questions like have the procedures been used before?, how did they work, and how long can the department function using them? 5. Evaluate any regulatory, legal, financial, customer service, and public image problems that could arise as a direct or indirect result of the application being unavailable through various time thresholds.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

8. 8 Other Questionnaires and Interviews  Executive and Administrative Staff  IS Staff supporting: Major Clinical Applications Interfaces Network Configuration Hardware/Servers  Facility Operations Business Impact Analysis  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

9. 9 GUNDERSEN LUTHERAN INVENTORY  Initial Y2K inventory had 700 items  Updates for current environment resulted in 170 applications  Interviews identified 122 server based applications and their associated runtime environments  Analysis identified 64 applications as “mission critical”  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

10. 10 APPLICATION AND SYSTEM CRITICALITY  Critical - Applications or resources impacting patient care. (No downtime is acceptable).  Essential - Applications or resources with patient health information, patient care data, billing, payroll and physical security. (Limited downtime).  Necessary - Department-level applications and systems. (Some downtime is acceptable).  Desirable - Applications and resources that can tolerate a significant loss of availability. (Recover when normal operations is established).  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

11. 11  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

12. 12 TOP 10 COMPONENTS 1.DataWarehaus 2.Clinical Workstation 3.Softlab 4.SMS 5.PP+ / Cycare 6.Lawson 7.Wellsoft 8.Orsos 9.Pharmacy 10.Internet/Intranet/Email  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

13. 13 CRITICAL COMPONENT ANALYSIS  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT Critical Essential Necessary Desirable Recovery Time Objective

14. 14 RISKS AND RECOMMENDATIONS CURRENT STRENGTHS  Knowledgeable staff.  Limited backup and restore strategies for most IT components are in place.  Telecom and pager systems meet current business needs.  Establishment of a second (backup) ISP is nearly complete so as to ensure Internet availability.  The Data Warehouse is housed on a high availability system.  IS is upgrading to a Netware release that enhances server security and availability.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

15. 15 RISKS AND RECOMMENDATIONS CURRENT OPPORTUNITIES  Migrate appropriate desktop-based applications to a server environment.  Assess and consolidate server environment.  Cluster servers to improve availability.  Expand the use of proactive monitoring of applications, systems and interfaces.  Implement standardized backup and recovery procedures across all systems.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

16. 16 RISKS AND RECOMMENDATIONS CURRENT WEAKNESSES  The Data Warehouse is the greatest risk area across Gundersen Lutheran’s IT environment due to no offsite redundant environment.  Interface availability and related data integrity.  Critical applications have no offsite redundancy and limited internal failover capability.  Need to build business continuance and disaster recovery into the life cycle of every IT component.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT

17. 17 BUSINESS IMPACT ANALYSIS PROJECT MOVING FORWARD – NEXT STEPS  Business Impact Analysis - Phase 2 Objectives:  Complete the comprehensive IT component audit.  Provide detailed input for determination of service level objectives.  Complete strategies for decreasing risk related to critical applications and IT components.  Additional Issues:  Identify critical desktop applications and local databases.  Include critical standalone systems in the BIA.  Consolidate the IS BC/DR plan with departmental plans.  SUMBER KEPUSTAKAAN : WWW.HIPAACOW.ORG/DOCS/DISASTERRECOVERYPRESENTATION_PETE.PPT