Modern healthcare is digital, which means an uninterruptable power supply (UPS) is the lifeblood of any medical facility or healthcare campus. In the event of power loss, patient care must continue, and data and health information must remain accessible. Any disruption to operations must be minimized and any interruption must be temporary at most.
A Prescription for Data Protection
Data backup and protection is critical for healthcare providers, regardless of whether a disruption causes a UPS to kick in. The Health Insurance Portability and Accountability Act (HIPAA) includes a security rule that requires both data backup and a disaster recovery plan.
For the healthcare providers, there is a lot of data that needs to be backed up, and widely distributed across systems and devices, so your data backup strategy must be thorough. In the day and age of cloud-based applications and Software-as-a-Service (SaaS) delivery models, do not assume all your data is automatically backed up.
A general rule of thumb is that you should keep at least three copies of your data, use two different forms of media, and keep one of those backups at a separate offsite location–you cannot rely on Microsoft Office 365 to meet all those criteria. Healthcare data is more than just Word documents and Excel spreadsheets. Your data backup must protect all records and Personally Identifiable Information (PII).
Healthcare providers must be extra diligent when it comes to cataloging all the information that must be safeguarded, including where it resides, how it is backed up, and where. Aside from computers, tablets, and servers, patient data can be stored in a wide variety of medical diagnostic systems in proprietary formats, adding variety to the types of endpoints that store data. All these endpoints must be mapped so that all data, including patient records, diagnostic imaging, test results, and email conversations between doctor and patient are replicated for redundancy.
But backing up all this data effectively is just the beginning. You cannot maintain a high level of patient care if you cannot retrieve the data after a disruption.
A Plan to Get Back Up and Running
Data backup and protection is just one aspect of a broader disaster recovery plan, which includes getting the data back.
While the cloud is a great enabler of offsite backup, you must set clear recovery time objectives (RTO) and recovery point objectives (RPO) for mission-critical information (e.g., active patient records, applications) so you can quickly restore operations. This restoration is part of a broader disaster recovery response that has a lot of other moving parts that ensure continuity of services and patient care.
Disaster recovery for healthcare must consider more than just data protection. It encompasses all the technological infrastructure and the people needed to maintain it. A disaster recovery plan must prepare the organization for any event that can disrupt data, applications, systems, and network infrastructure.
Disasters come in many forms, such as a cybersecurity threat to steal sensitive data. It could be a natural disaster, such as a hurricane or earthquake, both of which often lead to power outages–although electricity grids can fail for other reasons.
The point of the broader disaster recovery plan is to rebuild IT (Information Technology) infrastructure as part of the organization’s business continuity plan, which touches on personnel and facilities management as well as crisis communications. This makes disaster recovery planning a collaboration between IT staff and the management team.
Just as HIPAA makes demands on how healthcare providers manage and protect data, it also lays out risk assessment requirements. A disaster recovery plan must review all assets, threats, and vulnerabilities. This starts with a business impact analysis (BIA), which evaluates the impact on operations in the event of a disruption and what the losses might be if a healthcare provider’s system goes down, including data and applications.
The BIA should establish what the minimal resources are for the healthcare provider to maintain operations and what the objectives and assumptions are for recovery, and what to prioritize to get operations going again. Healthcare providers must have a clear understanding of what a disruption will mean for key departments and the impact on patient care, which IT applications are involved, and how data is processed and received by each department. Most of all, it is important to know how much downtime the healthcare provider can sustain on a department-by-department basis.
Downtime is not only dictated by information systems but also power. Even when there is no data loss or compromised systems, IT infrastructure cannot run without power, which is why having a UPS is a core component of any disaster recovery planning.
Power Is Always a Primary Concern
Patient data and applications are not much use without a power supply. Healthcare facilities are much like a data center, and they even have their own data centers as well as network connections to leverage cloud-computing services. Healthcare information systems are responsible for all aspects of service delivery–including patient administration, clinical tasks, and management of the facility itself–while linking to all hosts of medical devices and diagnostic software.
The loss of just one diagnostic system can lead to a lot of disruption, so a power outage that affects an entire healthcare campus can be catastrophic. The cause does not matter–power must be restored as soon as possible. So, having a UPS can mean the difference between life and death for certain patients.
What is an Uninterruptable Power Supply?
Not to be confused with a standby generator or auxiliary power system, an uninterruptable power supply (UPS) is a battery-based device that will provide near-instantaneous power in the event primary power is lost. A UPS is designed for providing a constant, consistent stream of energy no matter how extreme the disruption. In a hospital environment that is susceptible to outages caused by natural events or grid failure, having a UPS for key systems and devices can save lives. The right UPS not only steps in when the primary power fails, but it also compensates for other energy issues such as frequency differences and voltage surges, spikes, and sags.
In the age of digital healthcare, data and power are intertwined–both essential for patient care and uninterrupted delivery of medical services. The harsh reality is that it is not a matter of if a disruption will occur, but when. And just like any medical intervention, a hospital needs a treatment plan that will restore data, applications, and power to keep its heart beating without interruption.
