Discussion: View Thread

  • 1.  Downtime - Forum Discussion Event

    Posted 07-22-2024 19:58

    Hi everyone!

    We met today and a big topic of discussion with all of the cyber events recently was downtime and how very few, if any, sites are prepared for an extended downtime. Questions that have come up include, what do we rely heavily on the EHR for now that nurses who have never worked on paper may struggle with if the EHR was down for an extended period? How are we preparing the next generation to not only work in the EHR environment, but also be able to function and care for patients when an extended downtime occurs? What about in the ambulatory space? Perioperative? 

    Please reply to this post with questions/thoughts/additional discussion points and we will schedule a panel event this Fall to discuss as a group! Keep an eye out for more information from our Board of Directors!



    ------------------------------
    Rachael Clagett DNP, RN, NI-BC
    Nursing Informatics Manager/Asst CNIO
    President, Northwest Chapter of ANIA
    Billings Clinic
    Stevensville MT
    ------------------------------


  • 2.  RE: Downtime - Forum Discussion Event

    Posted 07-23-2024 14:39

    This is a great topic. 

    One question that has come up in our facility is layering our downtime policies and procedures to account for the different downtime possibilities, such as network, power, EHR, etc. and how to train staff to these different downtime procedures. 

    When it comes to biomedical equipment and cyber attacks that could affect this equipment, how to prevent and recognize breaches quickly and mitigation steps in those events for downtime processes. 



    ------------------------------
    Tatiane Schmid
    Clinical Analyst- Nurse Informaticist
    Madison Health
    Idaho Falls ID
    ------------------------------



  • 3.  RE: Downtime - Forum Discussion Event

    Posted 07-23-2024 14:39

    We talked a little about competency.  I don't know that we have a specific competency for our organization as of yet.  I know that we are putting up monthly topics around security for work and personal devices on our Intranet.  For instance, this month was about WiFi security.

    I also brought up our recent Code Cyber drills that were held at each of our facilities this past month.  

    We had a scenario with the following assumptions:

    Non-operational:  No internet or intranet, no network, no login, no network drives, no interfaces, no wi-fi, no hospital cellphones or landlines, no e-mail, no central physiological or telemetry monitoring, no arrythmia strip printing except with defibrillator, no central console for nurse call, no overnight oximetry devices, no RTLS, no video monitoring, no MARTTI, no printers except for downtime computers, no routine faxing, no Kronos (staff schedule or time card), no pneumatic tube system, no Office 365 including personal cell carrier, no SaaS solutions including via personal cell carrier.

    Operational:  Everbridge, Pulsara, in room bedside monitoring, emergency red phones, overhead paging (housewide only), Nurse call-over door light and sound, door access via badge readers, fire system, water, gasses, power and HVAC locally controlled, downtime computer and attached printer for policy and procedures, physician orders and downtime forms; personal cell phone with redundant Wi-Fi or service provider; public WiFi, PolicyStat and Healthwise via gues access (link or QR code), UpToDate and Lexicomp apps with preregistration; Point of Care testing devices, copiers, critical faxes only for outside facility communication.

    Scenario to reach as many units as possible was an OB Trauma--the scenario was six pages long but on a high level went through the following:

    OB/GYN Clinic-patient check-in, rooming, provider seeing patient, writing prescription and medication administration in the clinic, determines patient should be admitted to the hospital, closing the visit.

    Patient gets in traffic accident on the way to the hospital--taken by ambulance to the ED.

    ED-arrival with registration steps and care including labs and radiology

    L and D-bed management, supply chain to get supplies

    Preop/Surgery for C-section-getting consent, orders, surgery checklist, timeout, creating baby chart and banding, baby transferred to NICU, delivery summary, anesthesia writes PACU orders, OB writes port partum orders and op note.  Philips monitor having issues so work order to BioMed. Patient transferred to L and D PACU.

    NICU-orders, assessments, respiratory care orders for CPAP, donated breast milk, bilicheck, birth certificate information completed, discharge with dad.

    Patient having internal bleeding-general surgeon called, patient taken to the main OR for surgery, getting blood from blood bank. Patient taken from OR to ICU.

    ICU-therapy visits swallow screen, dietary orders, diet requisitions, blood ordering and transfusions, transfer to med/surg unit.

    Med/Surg-Care Management for consults, physical therapy, initiate Home Health.

    Pharmacy and Med Administration-create patient profile, review med orders, crate verification labels, indicate if med is in Pyxis or not, runners deliver patient medications and verification labels to unit.

    Discharge from hospital-referral to home health, discharge summary, patient education and avs, create copies of charting for home health.  Something wrong with the bed--tag for repair and taken out of service, facilities notified.

    Home Health Intake/Visit-insurance verification, review med rec, H and P, PT and SLP orders. Wound care, meds and labs.

    Questions asked of the staff in the process of the scenario:

    How will an MA know when the patient is ready for rooming?

    Where and how will you find charts for walk in patients?

    How will you find previous visit information on this patient?

    How will the clinician know the patient is ready to be seen?

    How does clinic support know there is an order for treatment during the visit?

    Are your clinicans and back office preregistered for UpToDate and Lexicomp?

    How do you know which phones will work during downtime?

    Where do you find the Red Phone Directory for the local medical center?

    How will clinic notify the hospital the patient is on their way?

    What additional steps must be completed in order to complete the visit?

    What happens when there are pending orders?

    How will the ambulance calls come into the ED?

    How will you call a Code or Trauma?

    How do you know which OB to call?

    How does Imaging let the nurse know they are ready for the pt?

    How will the Lab know who to call?

    If the lab result was critical, how would the provider be notified?

    How did you know the number for Bed Management?

    How will the unit let Supply Chain know it needs supplies now?

    Walk through the OR downtime processes?

    How did you know the number for the NICU?

    How did yu let the PACU know the patient was ready to transfer?

    Walk through the baby chart creation and registration?

    How is the birth recorded?

    How is the provider notified of pt change in condition?

    How did you know the number for the ICU?

    How will SLP be notified of the order?

    How will food request be sent to the kitchen?

    What is the process to validate that the correct diet order is delivered to the patient?

    How is EVS notified?

    How is EVS communicating bed status with Bed Management?

    How are Bed Management and the House Supervisor coordinating bed control?

    How does the handoff occur and who transports the baby?

    How is breast milk documented?

    If change of shift occurts for TR, how is baby status communicated, order review completed?

    If needing to transfer baby to a higher level of care, what are the steps?

    How are charges completed?

    Where does the chart go when completed?

    How are birth certificates handled in Code Cyber?

    How is Home Health notified of patient admission?

    How is Care Management arranging and communicating with transport companies?

    How will your hospital manage securely transporting medications?

    What are some safe processes for running and handing off controlled substances?

    How will you make copies of the chart?

    How does facilities know there is a repair request?

    Where does the completed hospital chart go?

    How does Home Health know about the new patient?

    How does Home Health know when to start their first visit?

    How do you communicate with the patient?

    How are orders placed and communicated?

    How does Home Health caregivers know when to see the patient?

    How will caregivers communicate about the patient?

    Where is the paper chart kept between visits?

    How are labs managed without an EMR?

    How will the lab results be communicated?

    Where does the completed chart go?

    How are charges completed?



    ------------------------------
    Shannon Roller
    Perioperative Informaticist (Epic Optime, Anesthesia)
    PeaceHealth
    Vancouver WA
    ------------------------------



  • 4.  RE: Downtime - Forum Discussion Event

    Posted 07-23-2024 14:39

    Looks like the responses are truly private to you and not for all of us to see--just so you are aware.  Not able to see my last response once I submitted it.  I will need to think about a few other things--periop is my specialty so I know a little about that anyway.

    The Crowdstrike was definitely a different type of downtime.

    1. Computers turned off overnight were not affected.
    2. Downtime computers were "down" as they need to get security updates.  This was unexpected by staff who have been told we will always have downtime computers available.
    3. Most other systems were not affected compared to if we had a true cyber-attack.
    4. Someone needed to touch each individual computer to remove the Crowdstrike driver update.  Instructions were given to multiple people deployed by the incident command.  We were paired with desktop analysts to give us the bitlock recovery keys and/or used a teams chat giving the chat the workstation number and they gave us the bitlock key to type in and then we were able to follow the steps to remove the update.
    5. If the Bitlock recovery key was not available or didn't work, desktop had to go back and reimage all the computers that we were not able to recovery via the steps we were given.
    6. Our medical centers were prioritized before community access and clinics.
    7. Providers and staff (for periop) didn't seem to know that they needed to keep a copy of their records to enter once the computers were up so will need to reinforce what downtime recovery procedures are for them.


    ------------------------------
    Shannon Roller
    Perioperative Informaticist (Epic Optime, Anesthesia)
    PeaceHealth
    Vancouver WA
    ------------------------------