In my opinion, the procedure that should be included in the plan is data replication. Because hospitals and healthcare sectors must always be up and running, I want to design my organization’s information system to be always available to provide seamless care for the patient. The replication system should be synchronous replication because the system needs instant failover if the primary server fails.

In my opinion, a disaster recovery plan shall be developed based on identification of threats and classification of risks, not only in terms of IT, but also infrastructure and human resources, as well as internal and external factors. For this purpose, the establishment of a disaster recovery committee at an early stage, consisting of multiple sectors, is quite important.
When it comes to a technology for recovery, I would apply data replication (DR) with a DR site in a remote location in order to ensure reducing Recovery Time and Point Objectives.

I believe that the replication technology may suit my organization more than a backup system because health data has been recorded throughout the day, and data are matter, so we need a system that can reduce the recovery point objective (RPO). Furthermore, replication technology provides a shortage of time to recovery (less recovery time objective, RTO), which is very important for the mission-critical application that must always be running to take care of a patient.

The Cisco’s Disaster Recovery document elaborated the best practices in developing plans in times of disaster. In developing the disaster recovery plan, it must constitute the following:

1. Identification of possible threats (physical or environmental) that may cause the disaster. A risk analysis is crucial for this part of the plan, which are considered through its predictability, scope, time of day, day of week, location, impact, likelihood, and advance warning. This will help in the estimation of cost, forecasting lost opportunities and entities affected, and possible outage/ downtime that may incur once that risk causes a disaster.

2. It must define the resources and processes that ensure business continuity during the disaster. This is synonymous on Business Continuity Plans that are activated in times of emergencies and/or disaster.

3. It must define disaster recovery mechanisms and contain evaluation of such from the time the business transitions from the recovery state to normal state.

In my current organization which currently entertain lots of clients, they employ both weekly/monthly backups and replicate servers to mitigate any forms of downtime. The Manila office has backup/ replicate centers overseas in case of disaster striking the Manila office. While it may be costly for the company, they invest in such IT systems to ensure uninterrupted services to its clients.

When developing disaster recovery plan, the back-up and restoration data procedure should be included in the plan. My workplace has been dealing with clinical trials data, in the form of hardcopies (informed consent, case report form) and softcopies (data entered to database). For the hardcopies, the papers were stored in a fire-proof cabinet inside a safe room with lock and the database is already online using database platforms that has a regular back-up regulation. For now, the physical server that we had is only one in the building and with the growing number of people, we need to have a back-up server that replicates the data.

Procedures for developing a disaster recovery plan include:
1. Disaster Risk/Threat Identification and Analysis
2. Risk Classification Based on Relative Weight
3. Build a Risk Assessment
4. Determining Disaster Impact
5. Evaluation of Disaster Recovery Mechanism
6. Disaster Recovery Committee

The appropriate technology for my organization is data backup in cloud computing. because Indonesia is a disaster-prone country, it will be very helpful if the data is stored in the cloud.

In my organization, I think data replication and backup are very important, especially in cloud computing (we usually use Onedrive now). We rarely use hard copies, so I think it is better to use technology to store and backup softcopies of the documents. Also, we should have a business continuity plan in place, to make sure all employees understand the procedures and are aware of the disaster.

To develop a disaster recovery plan, I think types of storage sites is one of the most important for effective disaster recovery plan. Physical data site to stored the hardcopies data should located away from any possible harm, fire and waterproof safe etc. For the virtual data storage, the data should be hosted in the cloud and managed by reliable third-party service providers. To develop disaster recovery plan for my organization, data replication may be more suitable due to the process of healthcare organization should continue running all the time to provide the seamless and effective patient care services.

Basically, Disaster Recovery Plan should start from identifying and classifying threats based on its impacts and chances of events occurings.

In my opinion, Disaster Recovery Plan should includes.
– Backup – Full Backup should be done periodically, I prefer to store my backup data separately on Cloud Storage or any remote storage devices to reduce risk of physical threats such as flooding and fire.
– Replication – My company always do a replication in DR Server. It would be great if we can do realtime replication. Or we should reduce RTO as short as possible.

In my point of view, data replication technology should be included in disaster recovery plan in the context of healthcare setting because the patient with critical conditions needs the information from the database to decide for the treatment. Data replication tends to accelerate the recovery time which helps the aforementioned situation.