August 2016

What's Your Plan?
By Beth W. Orenstein
Radiology Today
Vol. 17 No. 8 P. 18

Radiology departments need to be prepared for disaster.

In the first five months of this year, the Federal Emergency Management Agency (FEMA) declared 33 disasters, including floods in Arkansas, fires in Kansas, a winter storm in New Jersey, and land- and mudslides in Washington. That's on pace to match the 79 natural disasters FEMA declared in all of 2015. The numbers don't reflect shootings or other acts of terrorism.

HIPAA requires all health care providers to have a disaster recovery plan in place. Many of today's radiology departments could not operate if they were affected by natural disasters or even if they faced minor or major technical failures such as hardware failures and power outages caused by unexpected events. Fortunately, while most have not had to use their disaster recovery plans in emergency situations, they have had to keep them up to date and in tune with the advances in technology and EHRs.

Health care institutions can always benefit from new tools and technology in disaster recovery, says Beverly Rosipko, director of radiology informatics at University Hospitals in Cleveland and an author of "Design and Implementation of Disaster Recovery and Business Continuity Solution for Radiology PACS," published online in the Journal of Digital Imaging in August 2013. Given the need for continued attention to disaster recovery, Radiology Today asked several radiologists and IT specialists to talk about what's new in disaster recovery in radiology, what the biggest disaster recovery challenges are, and for their advice for upgrading a disaster recovery plan or keeping an existing plan up to date.

What's New
The way people think about disaster recovery is changing. The old way to think about disaster recovery is just that—as a recovery from disaster, says Keith J. Dreyer, DO, PhD, FACR, vice chairman of radiology computing and information sciences at Massachusetts General Hospital (MGH) in Boston. "Disaster recovery used to be where you kept copies of your imaging studies on and off premises," he says.

Today, disaster recovery also includes business continuity, which means that many facilities have a completely operational second site and could run a fully operational radiology reading department at either facility, should one go down. MGH has a completely separate computing facility with a separate power source about 25 miles away, Dreyer says. "We can run a fully operational department from either facility. Both contain a fully functional PACS."

Disaster recovery also used to mean offline backup. Today, there are more online options, such as RAID (redundant array of independent disks). MGH has multiple online backups, Dreyer says. However, he's still in favor of also having offline backups. "Tapes are inexpensive and provide an extra layer of redundancy," he says.

Another development in disaster recovery is cloud storage. The technology is there for cloud-based solutions for disaster recovery, but adoption hasn't caught up yet, says Dreyer, who is also chair of the ACR Commission on Informatics. Health care, unlike other businesses, has been slow to move to the cloud for storage, he says.

The issue, Dreyer surmises, is that hospitals want to make certain they have full control over their patient data: "Hospitals are stewards of patient data and could be reluctant to move it to the cloud for storage rather than having it on the premises." However, the sheer volume of data makes moving to the cloud more likely, Dreyer says. Partners HealthCare has more than 30 million exams stored across all of its hospitals and adds about 2 million a year.

Some hospital administrators also may question the security and reliability of the vendors who offer storage on the cloud, in part because they don't have a history that proves their worthiness, Dreyer says. "A legitimate concern is that many vendors that offer cloud storage haven't been around long, and we don't know exactly how long they'll be around." Before anyone turns data over, they want to know: "Is it a come-and-go company?" Dreyer says. "The advantage to tapes is they can be managed under your control. Sometimes the old-fashioned way of doing things is still of value."

However, Dreyer says, more radiology departments will be moving images to the cloud for deep learning—a technology that uses algorithms to identify, classify, and quantify disease patterns in images. It will be just one more step to store the images there as well, he says. At some point, it will make sense to use the cloud for both deep learning and archiving.

Some hospital radiology departments also have disaster recovery plans specifically designed for their emergency departments (EDs). In the event of a disaster or tragedy, "No one wants to hear that the hospital's ED or trauma unit can't take care of you because the power is down," says Enrico Perez, CRA, FAHRA, director of radiology at Winthrop-University Hospital in Long Island, New York. Perez determined that he wanted a separate backup for his ED so that radiologists could read without having to go to the modality itself. The ED has its own power source for an emergency and workstations with full functionality where radiologists can go to read if necessary.

"It may seem as if we're going backward in technology with this backup system," Perez says, "but it's really a way to keep operating and offering care at a higher level."

What the Challenges Are
As for biggest challenges associated with disaster recovery, the radiologists and department directors say cost, time, and planning are at the top. "It takes two to three times longer to catch up after a disaster," Perez says. "That's because you're not only getting all your systems back in place but you're continuing to provide service. So you're getting double work coming through the system, and you want to make sure you catch it all." The recovery process becomes labor intense for making sure you attach the right information to the right encounters, he says.

"It's not just a requisition to a set of films now," Perez says. "It's part of the EHR, and it's a little more complicated."

Another challenge is making sure the disaster recovery plan includes everything. When thinking about disaster recovery of image data, it has to be all encompassing, Dreyer says. Throughout the hospital, many departments have their own storage solutions. Radiology has one. Cardiology has one. Ophthalmology has one. Surgery has one. "You have to go out and find all the sources of your data and where they are stored so that your disaster recovery solution encompasses them all," Dreyer says.

Yet another challenge is making sure that everyone knows how to implement the disaster recovery plan, should it become necessary, says James A. Brink, MD, radiologist-in-chief of the department of radiology at MGH and chair of the ACR Board of Chancellors. It's one thing to have a plan, he says, "but it's another to make sure that everyone knows how to turn it on." It's important, too, that there be someone available at all hours who can switch to the backup because it's impossible to know what time it will be when a disaster occurs, he adds.

Disaster Recovery Tips
And what tips do the disaster recovery experts have?

Test your system now and then to be sure that it works. That's the best way to determine that it works properly. Brink is familiar with another institution that tested its ED recovery system only to discover that the power outlet it had planned to use in the ED was not on battery backup. "If you never go through operational testing, you won't find out things like that," he says.

The more specific you can be when testing, the better, Brink says. "It's not just enough to say images will flow in the right direction on backup. Are there operational issues? Do the technologists have to do something special to route to the server? Do exam histories flow properly? Is billing reporting part of your backup? How does it all work?"

Communications must be part of your plan. In the event of a disaster, everyone needs to know when the routine operations will be restored and when he or she can return to the production rather than the backup system, Brink says. "When we manage disasters at MGH, we have e-mail blasts sent out by the disaster recovery team with a certain known frequency. The blasts that go out tell everyone at a minimum: Here's where we stand. If something happens that needs to be communicated between scheduled blasts, we send out more communications." Providing routine updates to staff is critical because it keeps everyone informed, Brink says. "I can't emphasize enough how critical an issue this is because often so many rumors and news stories circulate, and the staff needs to be kept informed." Another possibility is to establish a phone number that everyone can call for updates at a certain time. If the power is out or the internet goes down, people may not see e-mail blasts, Brink says. Hopefully, they will still have phones that work.

Never let employees store any files containing patient health information on their personal computers. "That's health care 101," says RL "Skip" Kennedy, MSc, CIIP, technical director at Kaiser Permanente of Northern California. "All business transactions must be saved to network servers which are backed up every night." That seems like an obvious rule, "but you'd be surprised how many don't follow rules like that," Kennedy says.

Don't dismiss disaster recovery planning because you think it won't happen. "If you don't believe you're at any risk at all, you must be living in a perfect world," Kennedy says. That's not to say you should be consumed by having a disaster recovery plan in hand and making sure it can be implemented quickly and efficiently, he says, "but you need to plan even for what could happen, even if it is only once in a lifetime or never."

Think of the worst possible scenario and work backwards. "You do have to plan for the worst," Perez says. "Think about the what-ifs and pray they don't happen. But if you've thought of everything, at least you'll be prepared for it should it happen."

Consider the different layers and redundancy, not just for the data themselves but also for the applications and the hardware. "Make sure you have two locations of hardware and for the applications of the data, too," Rosipko says.

Disaster recovery requires an investment of time and money, Rosipko says. "But when it comes to protecting your data, it's important." Also, Rosipko adds, when University Hospitals established a more advanced disaster recovery system for its PACS with more robust duplication, much better uptime, and shorter scheduled upgrades, it proved to be "a more stable and more widely available clinical tool," she says. "We pride ourselves in having 99.9% uptime of our system."

— Beth W. Orenstein of Northampton, Pennsylvania, is a freelance medical writer and frequent contributor to Radiology Today.