Although the UK does not suffer from earthquakes and tsunamis, it is not immune from other threats. Cast the mind back to 2005, which saw the Buncefield oil depot explosion and the terrorist attacks in London; the flash floods in Kent in May 2018; and more recently, pity the TSB customers who found themselves dealing with the bank's failed systems and weeks of financial disruption.
The healthcare sector has not been exempted from its share of troubles.
Back in May 2018, the MK Citizen reported on a flash flood that affected the Saxon Clinic in Milton Keynes (MK Citizen, 2018). The majority of the hospital was flooded, causing extensive damage throughout and resulting in a clean-up operation that kept the staff busy right through a bank holiday weekend. Earlier in 2018, the clinic had to deal with power cuts, heating loss and road blockages caused by snow storms.
And just a month later, in June 2018, the BBC ran a story on a fire that broke out in a six-storey Harley Street block of flats (BBC, 2018). It took 10 fire engines and 72 firemen to put out the blaze that burned on the fourth and fifth floors. The building housed flats, a dental clinic and an eye clinic.
These examples illustrate why clinics need to plan for disruption. If this is done correctly, clinic owners could put themselves in a position that will strengthen their business compared with rivals who fail to plan ahead. As the City of York notes on its website, “disasters have no boundaries and whether you are a small or large business you may be affected. The main purpose of business continuity is to ensure that the organisation has a response to major disruptions that threaten its survival’.
Understand the business
The first step is to understand the business in terms of the potential threats to its normal operation. With staff, clinics should look at every aspect of the business and think about the people employed, what they need to operate and how they serve their clients.
Assess the risks
The threats to the business are many and although some of them seem improbable, they should all be considered:
They all sound very improbable, but they have happened, so each one is worth considering.
Develop your strategy and plan
On investigation, some risks can be ignored; others will be accepted but the clinic sets up a mutual arrangement with a neighbour to help each other out. Alternatively, it may choose to become self-sufficient.
However it is approached, the plan must be written in plain English so that all can understand it. Guidance on planning is available via free software called ROBUST. https://robust.riscauthority.co.uk/.
Build in protection
Contemplate where redundancy can be built in without adding too much extra cost. Although there's no point renting a spare building or equipment just in case of disaster, knowing where the clinic can rent certain pieces of equipment may save the day.
Remember, equipment—especially IT—can fail. The hard drive in a computer, for example, has a ‘mean time before failure’ rating, in other words, how long it's expected to operate before it fails. But that doesn't mean that it won't fail much sooner. Similarly, an (often automatic) update to the operating system on a computer may cause more problems that it cures. The key to both of these scenarios is to back up data regularly, at least once a day, and keep the backup offsite and accessible.
Communication is critical to business. This is especially acute if the telephone system is based on VoiP (internet) rather than a traditional line. Plan to use alternatives. Is there someone with a wireless connection with whom the clinic can agree a reciprocal piggy back arrangement if the broadband fails? Consider a 4G dongle or a mobile phone plan that comes with plenty of data. Consider having phones on two different networks, in case one fails.
Look at scanning and filing documents electronically. Fast double-sided automatic scanners will turn paper into PDF files that can be backed up and placed in a searchable archive on a computer. It will also be possible to store the originals elsewhere at a less expensive location to further spread the risk of loss.
Insurance
Despite rising costs, clinics should never skip on insurances. Indeed, business owners should make a point of recording when insurances are due and ensure that someone checks that they have been paid for. Similarly, it makes sense to note down the policy details and keep them offsite. Apart from the obvious insurance—premises, stock, vehicles, public liability and employers liability—clinics might also consider buying:
Regulatory
It would be a mistake not to mention the regulatory threats through changing legislation, case law and tax policy, any combination of which could impact a business. The forever changing ground of employment law is great case in point. Employees have become more litigious and, as discrimination awards have no limit, a good case proven could cost an employer thousands. Similarly, ignoring a tax demand from HMRC—even though it may be considered pure fantasy—could lead to bankruptcy if not addressed.
Write policies and risk assess
Having good polices and also risk assessing threats to the clinic will enable the business owner to forestall any obvious threats, such as simple fire risks, or more complex terrorist activity, but may also help to lower insurance premiums on the basis that the business presents a lower risk to the insurer. Further, having a plan in place will mean that everyone will know what to do in case of a disaster. For example, by writing a bad weather policy, both employer and staff know the effort that is expected when trying to get into work, and the pay/leave arrangements for when they fail to get in.
It also makes sense to consider employee issues—such as discrimination, bullying and sickness absence—a threat, in which case there should be policies for those too. The same applies to health and safety issues. A good policy will not necessarily get a business out of trouble if an incident occurs, but it will help it mitigate any penalties heading its way following an investigation.
Of course, legal advice should be sought before writing policies that are available for all to read.
Emergency contacts
Another worthwhile move is to draw up a list of emergency contacts that includes key staff, the utilities (water, gas, electricity, telephone and broadband), employment agencies and key suppliers. Remember also details of the accountant, solicitor and the tax / VAT office (with references). Neighbouring businesses shouldn't be left out in case they need to be informed, and nor should clients who may need contacting. At the same time, thought should be given to diverting calls if the building cannot be accessed.
Finally, having spent time, effort and money in creating a disaster recovery plan, it needs to be tested and kept up to date.
Conclusion
Ultimately, the threats affecting one business might be quite different for another. But the threats are real and should be considered in full, with plans being made to prepare for such eventualities.