As much as we hope every business is preparing a Disaster Recovery Plan (DRP) to deal with the growing technological advancements with storing and sharing ePHI, at this moment in time the majority are still lagging behind. When your company’s data or the Protected Health Information of your employees is compromised are you prepared to respond?
A Disaster Recovery Plan describes how an organization plans to handle potential disasters, created both by natural causes and human error. If you need an idea for where to start with your DRP, check out these 9 key elements to create your plan here.
Even if your business has created a DRP, have you tested it? A DRP cannot be assumed to work without testing the program. By testing, you are to identify deficiencies and validate you can implement the plan.
Here are 3 simple steps to take before you begin testing your Disaster Recovery Plan:
- Break it down – Look at your DRP and figure out how to divide it into different segments based on areas of responsibility. That way, when it comes to the lower levels of testing (checklist, walkthrough, and simulation), you do not have to perform a full-scale test.
- Periodically Review – We recommend your staff or your assigned Emergency Team Leaders meet at least quarterly to review the DRP.—Meaning, examine in great detail for missing information or deficiencies in the written plan.
- Set Objectives – Determine exactly what it is you want to accomplish with this test. Set goals for your workforce to meet and outline what steps should be taken in order to meet those goals.
After taking these steps you can begin the testing process. Let’s review the different types of tests:
- Checklist Testing- Create a checklist specific to each business process. Select teams who will carry out the responsibilities of each process. Checklists are cheap and easy to implement. This should be done before any other test because it acts as a foundation for the rest of the testing.
- Walk-Through Testing- Before trying any sort of simulation with your business, gather all workforce members in a meeting room to walk through each scenario step-by-step. Assure every employee understands their tasks and duties for the corresponding situation. Awareness of all members is key to a DRP and tabletop testing can effectively demonstrate their roles. Additionally, this is a great way to find documentation errors or inconsistencies in your DRP.
- Simulation Testing- Simulate a disaster as closely to a real disaster as possible without disrupting the business operation. This is the nearest you can get to a full test without interrupting daily operations.
- Full Interruption Testing- A full interruption test is costly and interrupts normal operations. This test is closest to the real thing so it will help reduce errors and will better prepare the workforce for a real disaster. In this case, you shut down operations at the primary site and recover at the alternate site as laid out in the procedures for your DRP. Only do this once your team has practiced enough and feels comfortable with your plan. Your business will literally be shut down during this test and will only come back if you successfully complete the recovery plan.
After completing a test, it is important to follow these steps in order to evaluate and document the effectiveness of your plan and your workforce:
- Identify Strengths and Weaknesses of the Plan- After completing the test, determine which aspects can be improved upon and which ones are working well. It’s also important to evaluate the steps that are taken and determine if any need to be added or if any are unnecessary or repetitive and can be removed from the plan.
- Give Feedback on Performance- Remember to take notes throughout the test on the performance of each team or function. This will make giving feedback easier. The teams need to know what they did well and what needs improvement in order to make the Disaster Recovery Plan most effective.
- Write Final Report- The final report should include objective results, performance overall and by teams, a summary of the test, and future recommendations. It should sum up the results of the test for future reference.
You should run a simulation of your disaster recovery plan so that your procedures become routine to your organization and team members. It is not enough to have a DRP written down and filed away. The DRP should be tested and ready to be successfully implemented.
