Continuous industry risks for South Africa healthcare

"Combined, these risks create a distinctive risk profile for companies in this sector," says, Lynette Smit, a Business Continuity advisor at ContinuitySA. "The company's experience in both the public and private health care sectors shows that certain risks are particularly acute in South Africa and that many of them are overlooked. This may be because they are not directly related to the company's core business; however, they could have a huge potential impact on it."

The company believes that the following eight risks particularly affect the South African health care sector and should be factored into organisations' business continuity planning schedules.

1. Outdated buildings and infrastructure - this risk is particularly high in the public sector, as many buildings are leased, and property owners do not undertake proper maintenance. In addition, many public health facilities are in old buildings in which wiring can be faulty, or in which sprinkler systems are not installed, due to heritage regulations. Working in such conditions can negatively affect staff morale and pose a threat to the safety of both staff and patients.

2. Over-reliance on third-party suppliers - for budget reasons much specialised equipment is leased and is often outdated. This in turn places the organisation at the mercy of suppliers and service organisations because maintenance engineers, or replacement equipment in the event of a breakdown, are scarce. Another supply chain vulnerability is the industry's heavy reliance on drivers and couriers for the transport of specimens to medical facilities-union activity can thus affect heavily. In addition, slow procurement processes bedevil the public health sector.

3. Power interruptions - power outages are set to increase in frequency and severity for the near future, a definite risk for organisations dealing with life-and-death issues. Too many healthcare organisations have generators with limited diesel supply and uncertain maintenance and testing schedules. "A crisis or power outage is the wrong time to find out your alternative power source is inoperative or can only sustain you for a short period of time," Smit notes.

4. Poor IT infrastructure and disaster recovery - all businesses are dependent on IT, but none more than medical laboratories or research facilities. Another problem is that business critical and client-sensitive data is frequently stored on unsecured laptops. Despite their high reliance on IT, health care companies often do not have adequate IT disaster recovery plans in place, and testing is not performed regularly to ensure both data and systems can be restored within specified time limits. Another critical IT dependency for health care is bandwidth, particularly when it comes to remote facilities.

5. Inadequate security of critical paper documentation - the flipside of the health care sector's IT risk is its continued high dependence on paper documentation, such as highly confidential patient records, which also creates vulnerability. Storage of documentation in digital formats is considered to be leading practice. ContinuitySA recommends the implementation of an electronic document management system to ensure compliance with the Protection of Personal Information Act, or the building of a fit-for-purpose document storage facility with adequate redundancy.

6. Skills shortages - specialist human resources are a feature of the health care industry but they are in short supply. An organisation can find itself reliant on certain individuals who cannot easily be replaced. Exacerbating factors include high attrition rates in the sector owing to low morale, and lengthy recruitment processes

7. Crime - while all South African businesses face high risk from criminal activity, health care companies have a higher risk because goods/samples/specimens are often stolen from research and or storage facilities because they form critical evidence in impending court cases. The loss of years of research findings or the theft of patient information during a robbery also constitutes a risk as the findings are often irreplaceable and patient information can be highly sensitive in nature.

8. Inadequate buffer stocks - industry standards stipulate that healthcare facilities must carry at least 30 days' worth of buffer stocks.
   

ContinuitySA is one of Africa's leading provider of business continuity management and related services. For more information, go to www.continuitysa.com.