787 974 136
The healthcare sector is one of those areas where an IT system outage, a power failure or a disruption to the supply chain for medicines and medical supplies can have a direct impact on patient safety. A hospital cannot simply ‘close for the day’ and resume operations the following day. Business continuity in healthcare is not a matter of convenience – it is a matter of life and health. ISO 22301 provides tools to manage these risks in a systematic manner.
The healthcare sector stands out from other sectors due to several characteristics that give business continuity management a distinctive character.
The uninterrupted provision of services is the fundamental difference between a hospital and a manufacturing or service company. Intensive care units, operating theatres and A&E departments – these units operate round the clock and cannot suspend their activities even for a short period. A business continuity plan must account for disruption scenarios affecting each of these areas separately and specify the minimum resources required to maintain life-saving services.
The complexity of critical infrastructure. A hospital is an environment with an extremely extensive and interconnected infrastructure: emergency power supply systems, generator sets, medical gas systems, air conditioning and ventilation in operating theatres, IT systems (HIS, PACS, LIS), and life-support and diagnostic equipment. A failure of any one of these elements can trigger a cascade of disruptions. A hospital’s BIA must map these interdependencies in far greater detail than in a typical organisation.
Staff management during a crisis. A hospital cannot function without qualified medical staff. A business continuity plan must set out procedures for managing staff during incidents – ranging from mass staff illness, through unforeseen events, to situations requiring an urgent change to the rota. The COVID-19 pandemic has painfully highlighted how a sudden staff shortage poses a critical threat to the business continuity of healthcare facilities.
The supply chain for medicines, blood and medical supplies. A disruption to the supply of essential medicines, blood products, disposable items or medical gases can directly endanger patients. ISO 22301 requires that business continuity plans include monitoring of key suppliers and alternative supply routes in the event of a disruption to the main supply chain.
How should the continuity of IT systems be planned? IT systems are now a critical part of the infrastructure of any healthcare facility. Electronic health records, systems for ordering and receiving test results, pharmacy systems and billing systems – a failure or ransomware attack affecting any of these could bring the entire facility to a standstill. The continuity plan must specify procedures for operating in manual (paper-based) mode in the event of IT system unavailability, the maximum permissible downtime for each system (RTO), and requirements for data backup and recovery (RPO). System recovery tests following an incident must be carried out regularly and involve medical staff, not just the IT department.
What about power supply and technical infrastructure? An emergency power supply is an absolute requirement in a hospital – and is regulated by law. However, simply having generator sets is not the same as having a business continuity plan for the power infrastructure. ISO 22301 requires that procedures for activating emergency power supplies be documented, regularly tested (including through load transfer drills) and known to all technical and medical staff. Similarly, medical gas systems, operating theatre ventilation and air conditioning must be managed.
How should one manage a mass influx of patients or an evacuation? Mass incidents – disasters, epidemics, and chemical, radiological or biological incidents – can, within a short period of time, increase the demand for medical care many-fold or necessitate the evacuation of patients. ISO 22301 requires business continuity plans to cover scenarios involving a mass influx of patients, set out procedures for triage and prioritisation of care, and define the principles for cooperation with other healthcare facilities and emergency services. Evacuation procedures must take into account patients who are unable to move unaided and those connected to life-support equipment.
The healthcare sector is covered by the NIS2 Directive as a critical sector – which means that healthcare organisations meeting the size thresholds specified in the directive are obliged to implement cybersecurity risk management measures, including business continuity planning and incident management. In Poland, the transposition of NIS2 imposes these obligations on hospitals and other healthcare organisations providing critical services.
Irrespective of NIS2, Polish law regulates the requirements for business continuity in medical facilities through a number of legislative acts – the Act on Medical Activity, regulations concerning the State Medical Emergency Service, and requirements regarding the protection of medical data. ISO 22301 does not replace any of these requirements, but creates a systematic framework that enables them all to be implemented in a consistent and documented manner.
For healthcare facilities applying for ISO 22301 certification, the key challenge is integrating the business continuity management system with existing crisis management procedures, evacuation plans and mass incident response procedures. A well-designed ISO 22301 system does not duplicate these documents – it integrates them into a single, coherent management system, ensuring that all disruption scenarios are covered by the plans, tested and regularly updated.
If you’d like to find out how setting up such a system works in practice, take a look at our page on ISO 22301.
DJB DORADZTWO
Marcin Chorąży
