Clinical continuity and the recovery objective

Starting from the clinical procedure

Every provider has downtime procedures — paper forms, manual processes, verbal handover. Most were written years ago, few have been rehearsed recently, and almost none have been tested at the scale a real event would require.

The recovery plan should be built backwards from these. How long can the organization deliver safe care without systems? That number, produced by clinical leadership, sets the recovery objective.

This inverts the usual sequence, in which IT proposes an objective based on what infrastructure can achieve and clinical leadership is asked to accept it. The inversion matters because a technically achievable target that does not match clinical tolerance is the wrong target regardless of how well it is delivered.

The restoration sequence

Not everything can be restored simultaneously, so the order has to be decided in advance and agreed clinically.

Identity first, because nothing else can be restored until people can authenticate — and because identity recovery is consistently the least rehearsed element of a recovery plan. Then the clinical record, and specifically the read-only access path to it. Then scheduling and patient flow, which determine whether the organization can operate at all. Then diagnostics and results routing, where delays translate directly to clinical risk. Then revenue cycle, which matters enormously and is genuinely not first.

Writing this down before an incident converts a series of contested decisions under pressure into an executed plan.

• Identity and authentication, rehearsed as a distinct step
• The clinical record, including the read-only access path
• Scheduling and patient flow
• Diagnostics and results routing
• Revenue cycle, which is important and is not first

What the rehearsal has to include

An IT-only recovery exercise validates the technology and misses the point.

The exercise that produces useful findings involves clinical leadership, runs the downtime procedures for a realistic period, and tests whether the paper process works at volume rather than in principle. Every provider we have seen do this properly has found something significant, which is the argument for doing it deliberately rather than discovering it during an event.

The findings are usually not technical. They concern where the downtime forms are stored, whether staff have ever used them, whether a ward can actually operate on paper for the period the plan assumes, and who is authorised to declare an incident. All of these are cheap to fix on a planned Saturday and expensive to discover otherwise.